Mirror
/
zulip
mirror of https://github.com/zulip/zulip.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
zulip/requirements
History
Mateusz Mandera 06c2161f7e auth: Use zxcvbn to ensure password strength on server side. 
For a long time, we've been only doing the zxcvbn password strength
checks on the browser, which is helpful, but means users could through
hackery (or a bug in the frontend validation code) manage to set a
too-weak password.  We fix this by running our password strength
validation on the backend as well, using python-zxcvbn.

In theory, a bug in python-zxcvbn could result in it producing a
different opinion than the frontend version; if so, it'd be a pretty
bad bug in the library, and hopefully we'd hear about it from users,
report upstream, and get it fixed that way. Alternatively, we can
switch to shelling out to node like we do for KaTeX.

Fixes #6880.
 		2019-11-21 10:23:37 -08:00
..
README.md requirements: Improve README's format. 2018-05-26 06:26:14 -07:00
common.in auth: Use zxcvbn to ensure password strength on server side. 2019-11-21 10:23:37 -08:00
dev.in requirements: Upgrade fakeldap to master. 2019-10-17 16:49:53 -07:00
dev.txt auth: Use zxcvbn to ensure password strength on server side. 2019-11-21 10:23:37 -08:00
docs.in docs: Upgrade recommonmark to 0.6.0, fixing issues. 2019-10-02 12:29:24 -07:00
docs.txt requirements: Upgrade Python requirements. 2019-11-11 17:19:46 -08:00
mypy.in mypy: Upgrade from 0.730 to 0.740. 2019-11-13 12:38:45 -08:00
mypy.txt mypy: Upgrade from 0.730 to 0.740. 2019-11-13 12:38:45 -08:00
pip.in requirements: Generate pip.txt from pip.in like the other *.txt files. 2019-09-23 13:23:58 -07:00
pip.txt requirements: Upgrade Python requirements. 2019-11-11 17:19:46 -08:00
prod.in requirements: Remove unnecessary version bounds from *.in. 2019-09-23 13:23:58 -07:00
prod.txt auth: Use zxcvbn to ensure password strength on server side. 2019-11-21 10:23:37 -08:00
thumbor-dev.in requirements: Remove unnecessary version bounds from *.in. 2019-09-23 13:23:58 -07:00
thumbor-dev.txt requirements: Upgrade Python requirements. 2019-11-11 17:19:46 -08:00
thumbor.in requirements: Remove unnecessary version bounds from *.in. 2019-09-23 13:23:58 -07:00
thumbor.txt requirements: Upgrade Python requirements. 2019-11-11 17:19:46 -08:00

README.md

The dependency graph of the requirements is as follows:

dev         prod
+ +          +
| +->common<-+
v
mypy,docs

Of the files, only dev, prod, and mypy have been used in the install scripts directly. The rest are implicit dependencies.

common and dev are locked.

Steps to update a lock file, e.g. to update ipython from 5.3.0 to 6.0.0 in common.in and propagate it to dev.txt and prod.txt: 0. Replace ipython==5.4.1 with ipython==6.0.0 in common.in.

  1. Run ./tools/update-locked-requirements.
  2. Increase PROVISION_VERSION in version.py.
  3. Run ./tools/provision to install the new deps and test them.
  4. Commit your changes.