python-Flask-Security-Too/python-Flask-Security-Too.spec

125 lines
4.8 KiB
RPMSpec
Raw Normal View History

#
# spec file for package python-Flask-Security-Too
#
# Copyright (c) 2024 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
2020-04-05 08:37:47 +00:00
# Please submit bugfixes or comments via https://bugs.opensuse.org/
#
%{?sle15_python_module_pythons}
Name: python-Flask-Security-Too
Version: 5.3.3
Release: 0
Summary: Security for Flask apps
2020-04-05 08:37:47 +00:00
License: MIT
URL: https://github.com/Flask-Middleware/flask-security
Source: https://files.pythonhosted.org/packages/source/F/Flask-Security-Too/Flask-Security-Too-%{version}.tar.gz
2020-04-05 08:37:47 +00:00
Patch0: no-mongodb.patch
# PATCH-FIX-OPENSUSE Use pyqrcodeng, we do not ship qrcode in OpenSUSE.
- Update to 4.1.2: * default_reauthn_handler doesn't honor SECURITY_URL_PREFIX * Add public API and CLI command to change a user's password. * Add type hints. Please note that many of the packages that flask-security * Add first-class support for using username for signing in. * Possible open redirect vulnerability. * Improve cookie handling and default ``samesite`` to ``Strict``. * Email validation confusion - added documentation. * Add documentation on how to override specific error messages. * Don't install global-scope tests. * Add Blinker as explicit dependency, improve/fix celery usage docs, don't require pyqrcode unless authenticator configured, improve SMS configuration variables documentation. * Your UserModel must contain ``fs_uniquifier`` * Removal of python 2.7 and <3.6 support * Remove two-factor `/tf-confirm` endpoint and use generic `freshness` mechanism. * Remove ``SECURITY_BACKWARDS_COMPAT_AUTH_TOKEN_INVALID(ATE)``. In addition to not making sense - the documentation has never been correct. * Add 2FA Validity Window so an application can configure how often the second factor has to be entered. * Add HTML5 Email input types to email fields. - Refresh no-mongodb.patch - Drop patches: * no-setup-dependencies.patch * fix-dependencies.patch * 0001-Do-not-raise-a-TypeError-exception-if-phone.data-is-.patch - Add patch use-pyqrcodeng.patch: * Use pyqrcodeng rather than pyqrcode. OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=14
2022-02-28 06:21:54 +00:00
Patch1: use-pyqrcodeng.patch
# PATCH-FIX-UPSTREAM Based on gh#Flask-Middleware/flask-security#900
Patch2: support-python-312.patch
BuildRequires: %{python_module Authlib}
BuildRequires: %{python_module Babel >= 2.10.0}
- Update to 5.3.0: * Improvements to recoverability and confirmation to align with OWASP best practices and reduce possible exploitation. * Webauthn Updates to handling of transport. * Fix MongoDB support by eliminating dependency on flask-mongoengine. Improve MongoDB quickstart. * Fix Quickstart for SQLAlchemy with scoped session. * Login no longer, by default, checks for email deliverability. * Token authentication is no longer accepted on endpoints which only allow 'session' as authentication-method. (N247S) * /reset and /confirm and GENERIC_RESPONSES and additional form args don't mix. * Reset password can be exploited and other OWASP improvements. * Confirmation can be exploited and other OWASP improvements. * Convert to pyproject.toml, build, remove setup.py/.cfg. * the tf_validity feature now ONLY sets a cookie - and the token is no longer returned as part of a JSON response. * Fix login/unified signin templates to properly send CSRF token. Add more tests. * Improve Social Oauth example code. - 5.2.0: * Small updates to work with latest Flask/Werkzeug. * Drop support for Python 3.7 * Drop support for older versions of dependent packages (such as Flask). * Remove old Werkzeug compatibility check. * Compatibility with Quart. * Remove dependence on pkg_resources / setuptools (use importlib_resources package) * Fix tests to work with latest Werkzeug/Flask. Update requirements_low to match current releases. * Drop support for Python 3.7 - 5.1.2: * Hungarian translations not working. * Fix documentation for send_mail. (gg) * Fix for latest mongoengine and mongomock. * Fix inappropriate use of &thinsp& in French translations. (maxdup) * Improve documentation around subclassing forms. OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=31
2023-08-03 11:53:44 +00:00
BuildRequires: %{python_module Flask >= 2.3.2}
BuildRequires: %{python_module Flask-Babel >= 3.1.0}
BuildRequires: %{python_module Flask-Login >= 0.6.2}
BuildRequires: %{python_module Flask-Mailman >= 0.3.0}
2020-04-05 08:37:47 +00:00
BuildRequires: %{python_module Flask-Principal >= 0.4.0}
- Update to 5.3.0: * Improvements to recoverability and confirmation to align with OWASP best practices and reduce possible exploitation. * Webauthn Updates to handling of transport. * Fix MongoDB support by eliminating dependency on flask-mongoengine. Improve MongoDB quickstart. * Fix Quickstart for SQLAlchemy with scoped session. * Login no longer, by default, checks for email deliverability. * Token authentication is no longer accepted on endpoints which only allow 'session' as authentication-method. (N247S) * /reset and /confirm and GENERIC_RESPONSES and additional form args don't mix. * Reset password can be exploited and other OWASP improvements. * Confirmation can be exploited and other OWASP improvements. * Convert to pyproject.toml, build, remove setup.py/.cfg. * the tf_validity feature now ONLY sets a cookie - and the token is no longer returned as part of a JSON response. * Fix login/unified signin templates to properly send CSRF token. Add more tests. * Improve Social Oauth example code. - 5.2.0: * Small updates to work with latest Flask/Werkzeug. * Drop support for Python 3.7 * Drop support for older versions of dependent packages (such as Flask). * Remove old Werkzeug compatibility check. * Compatibility with Quart. * Remove dependence on pkg_resources / setuptools (use importlib_resources package) * Fix tests to work with latest Werkzeug/Flask. Update requirements_low to match current releases. * Drop support for Python 3.7 - 5.1.2: * Hungarian translations not working. * Fix documentation for send_mail. (gg) * Fix for latest mongoengine and mongomock. * Fix inappropriate use of &thinsp& in French translations. (maxdup) * Improve documentation around subclassing forms. OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=31
2023-08-03 11:53:44 +00:00
BuildRequires: %{python_module Flask-SQLAlchemy >= 3.0.3}
BuildRequires: %{python_module Flask-WTF >= 1.1.1}
BuildRequires: %{python_module MarkupSafe >= 2.1.0}
2020-04-05 08:37:47 +00:00
BuildRequires: %{python_module PyQRCode >= 1.2}
- Update to 5.3.0: * Improvements to recoverability and confirmation to align with OWASP best practices and reduce possible exploitation. * Webauthn Updates to handling of transport. * Fix MongoDB support by eliminating dependency on flask-mongoengine. Improve MongoDB quickstart. * Fix Quickstart for SQLAlchemy with scoped session. * Login no longer, by default, checks for email deliverability. * Token authentication is no longer accepted on endpoints which only allow 'session' as authentication-method. (N247S) * /reset and /confirm and GENERIC_RESPONSES and additional form args don't mix. * Reset password can be exploited and other OWASP improvements. * Confirmation can be exploited and other OWASP improvements. * Convert to pyproject.toml, build, remove setup.py/.cfg. * the tf_validity feature now ONLY sets a cookie - and the token is no longer returned as part of a JSON response. * Fix login/unified signin templates to properly send CSRF token. Add more tests. * Improve Social Oauth example code. - 5.2.0: * Small updates to work with latest Flask/Werkzeug. * Drop support for Python 3.7 * Drop support for older versions of dependent packages (such as Flask). * Remove old Werkzeug compatibility check. * Compatibility with Quart. * Remove dependence on pkg_resources / setuptools (use importlib_resources package) * Fix tests to work with latest Werkzeug/Flask. Update requirements_low to match current releases. * Drop support for Python 3.7 - 5.1.2: * Hungarian translations not working. * Fix documentation for send_mail. (gg) * Fix for latest mongoengine and mongomock. * Fix inappropriate use of &thinsp& in French translations. (maxdup) * Improve documentation around subclassing forms. OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=31
2023-08-03 11:53:44 +00:00
BuildRequires: %{python_module SQLAlchemy}
BuildRequires: %{python_module WTForms-lang}
BuildRequires: %{python_module WTForms}
- Update to 5.3.0: * Improvements to recoverability and confirmation to align with OWASP best practices and reduce possible exploitation. * Webauthn Updates to handling of transport. * Fix MongoDB support by eliminating dependency on flask-mongoengine. Improve MongoDB quickstart. * Fix Quickstart for SQLAlchemy with scoped session. * Login no longer, by default, checks for email deliverability. * Token authentication is no longer accepted on endpoints which only allow 'session' as authentication-method. (N247S) * /reset and /confirm and GENERIC_RESPONSES and additional form args don't mix. * Reset password can be exploited and other OWASP improvements. * Confirmation can be exploited and other OWASP improvements. * Convert to pyproject.toml, build, remove setup.py/.cfg. * the tf_validity feature now ONLY sets a cookie - and the token is no longer returned as part of a JSON response. * Fix login/unified signin templates to properly send CSRF token. Add more tests. * Improve Social Oauth example code. - 5.2.0: * Small updates to work with latest Flask/Werkzeug. * Drop support for Python 3.7 * Drop support for older versions of dependent packages (such as Flask). * Remove old Werkzeug compatibility check. * Compatibility with Quart. * Remove dependence on pkg_resources / setuptools (use importlib_resources package) * Fix tests to work with latest Werkzeug/Flask. Update requirements_low to match current releases. * Drop support for Python 3.7 - 5.1.2: * Hungarian translations not working. * Fix documentation for send_mail. (gg) * Fix for latest mongoengine and mongomock. * Fix inappropriate use of &thinsp& in French translations. (maxdup) * Improve documentation around subclassing forms. OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=31
2023-08-03 11:53:44 +00:00
BuildRequires: %{python_module Werkzeug >= 2.3.3}
BuildRequires: %{python_module argon2_cffi >= 21.3.0}
BuildRequires: %{python_module bcrypt >= 4.0.1}
- Update to 5.3.0: * Improvements to recoverability and confirmation to align with OWASP best practices and reduce possible exploitation. * Webauthn Updates to handling of transport. * Fix MongoDB support by eliminating dependency on flask-mongoengine. Improve MongoDB quickstart. * Fix Quickstart for SQLAlchemy with scoped session. * Login no longer, by default, checks for email deliverability. * Token authentication is no longer accepted on endpoints which only allow 'session' as authentication-method. (N247S) * /reset and /confirm and GENERIC_RESPONSES and additional form args don't mix. * Reset password can be exploited and other OWASP improvements. * Confirmation can be exploited and other OWASP improvements. * Convert to pyproject.toml, build, remove setup.py/.cfg. * the tf_validity feature now ONLY sets a cookie - and the token is no longer returned as part of a JSON response. * Fix login/unified signin templates to properly send CSRF token. Add more tests. * Improve Social Oauth example code. - 5.2.0: * Small updates to work with latest Flask/Werkzeug. * Drop support for Python 3.7 * Drop support for older versions of dependent packages (such as Flask). * Remove old Werkzeug compatibility check. * Compatibility with Quart. * Remove dependence on pkg_resources / setuptools (use importlib_resources package) * Fix tests to work with latest Werkzeug/Flask. Update requirements_low to match current releases. * Drop support for Python 3.7 - 5.1.2: * Hungarian translations not working. * Fix documentation for send_mail. (gg) * Fix for latest mongoengine and mongomock. * Fix inappropriate use of &thinsp& in French translations. (maxdup) * Improve documentation around subclassing forms. OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=31
2023-08-03 11:53:44 +00:00
BuildRequires: %{python_module bleach >= 6.0.0}
2020-04-05 08:37:47 +00:00
BuildRequires: %{python_module cachetools >= 3.1.0}
- Update to 5.3.0: * Improvements to recoverability and confirmation to align with OWASP best practices and reduce possible exploitation. * Webauthn Updates to handling of transport. * Fix MongoDB support by eliminating dependency on flask-mongoengine. Improve MongoDB quickstart. * Fix Quickstart for SQLAlchemy with scoped session. * Login no longer, by default, checks for email deliverability. * Token authentication is no longer accepted on endpoints which only allow 'session' as authentication-method. (N247S) * /reset and /confirm and GENERIC_RESPONSES and additional form args don't mix. * Reset password can be exploited and other OWASP improvements. * Confirmation can be exploited and other OWASP improvements. * Convert to pyproject.toml, build, remove setup.py/.cfg. * the tf_validity feature now ONLY sets a cookie - and the token is no longer returned as part of a JSON response. * Fix login/unified signin templates to properly send CSRF token. Add more tests. * Improve Social Oauth example code. - 5.2.0: * Small updates to work with latest Flask/Werkzeug. * Drop support for Python 3.7 * Drop support for older versions of dependent packages (such as Flask). * Remove old Werkzeug compatibility check. * Compatibility with Quart. * Remove dependence on pkg_resources / setuptools (use importlib_resources package) * Fix tests to work with latest Werkzeug/Flask. Update requirements_low to match current releases. * Drop support for Python 3.7 - 5.1.2: * Hungarian translations not working. * Fix documentation for send_mail. (gg) * Fix for latest mongoengine and mongomock. * Fix inappropriate use of &thinsp& in French translations. (maxdup) * Improve documentation around subclassing forms. OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=31
2023-08-03 11:53:44 +00:00
BuildRequires: %{python_module cryptography >= 40.0.2}
BuildRequires: %{python_module dateutil}
BuildRequires: %{python_module email-validator >= 2.0}
- Update to 5.3.0: * Improvements to recoverability and confirmation to align with OWASP best practices and reduce possible exploitation. * Webauthn Updates to handling of transport. * Fix MongoDB support by eliminating dependency on flask-mongoengine. Improve MongoDB quickstart. * Fix Quickstart for SQLAlchemy with scoped session. * Login no longer, by default, checks for email deliverability. * Token authentication is no longer accepted on endpoints which only allow 'session' as authentication-method. (N247S) * /reset and /confirm and GENERIC_RESPONSES and additional form args don't mix. * Reset password can be exploited and other OWASP improvements. * Confirmation can be exploited and other OWASP improvements. * Convert to pyproject.toml, build, remove setup.py/.cfg. * the tf_validity feature now ONLY sets a cookie - and the token is no longer returned as part of a JSON response. * Fix login/unified signin templates to properly send CSRF token. Add more tests. * Improve Social Oauth example code. - 5.2.0: * Small updates to work with latest Flask/Werkzeug. * Drop support for Python 3.7 * Drop support for older versions of dependent packages (such as Flask). * Remove old Werkzeug compatibility check. * Compatibility with Quart. * Remove dependence on pkg_resources / setuptools (use importlib_resources package) * Fix tests to work with latest Werkzeug/Flask. Update requirements_low to match current releases. * Drop support for Python 3.7 - 5.1.2: * Hungarian translations not working. * Fix documentation for send_mail. (gg) * Fix for latest mongoengine and mongomock. * Fix inappropriate use of &thinsp& in French translations. (maxdup) * Improve documentation around subclassing forms. OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=31
2023-08-03 11:53:44 +00:00
BuildRequires: %{python_module importlib_resources >= 5.10.0}
2020-04-05 08:37:47 +00:00
BuildRequires: %{python_module itsdangerous >= 1.1.0}
- Update to 5.3.0: * Improvements to recoverability and confirmation to align with OWASP best practices and reduce possible exploitation. * Webauthn Updates to handling of transport. * Fix MongoDB support by eliminating dependency on flask-mongoengine. Improve MongoDB quickstart. * Fix Quickstart for SQLAlchemy with scoped session. * Login no longer, by default, checks for email deliverability. * Token authentication is no longer accepted on endpoints which only allow 'session' as authentication-method. (N247S) * /reset and /confirm and GENERIC_RESPONSES and additional form args don't mix. * Reset password can be exploited and other OWASP improvements. * Confirmation can be exploited and other OWASP improvements. * Convert to pyproject.toml, build, remove setup.py/.cfg. * the tf_validity feature now ONLY sets a cookie - and the token is no longer returned as part of a JSON response. * Fix login/unified signin templates to properly send CSRF token. Add more tests. * Improve Social Oauth example code. - 5.2.0: * Small updates to work with latest Flask/Werkzeug. * Drop support for Python 3.7 * Drop support for older versions of dependent packages (such as Flask). * Remove old Werkzeug compatibility check. * Compatibility with Quart. * Remove dependence on pkg_resources / setuptools (use importlib_resources package) * Fix tests to work with latest Werkzeug/Flask. Update requirements_low to match current releases. * Drop support for Python 3.7 - 5.1.2: * Hungarian translations not working. * Fix documentation for send_mail. (gg) * Fix for latest mongoengine and mongomock. * Fix inappropriate use of &thinsp& in French translations. (maxdup) * Improve documentation around subclassing forms. OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=31
2023-08-03 11:53:44 +00:00
BuildRequires: %{python_module passlib >= 1.7.4}
BuildRequires: %{python_module peewee >= 3.16.2}
BuildRequires: %{python_module phonenumbers}
BuildRequires: %{python_module pip}
BuildRequires: %{python_module pony if %python-base < 3.11}
BuildRequires: %{python_module pytest >= 6.2.5}
BuildRequires: %{python_module requests}
2020-04-05 08:37:47 +00:00
BuildRequires: %{python_module setuptools}
- Update to 5.3.0: * Improvements to recoverability and confirmation to align with OWASP best practices and reduce possible exploitation. * Webauthn Updates to handling of transport. * Fix MongoDB support by eliminating dependency on flask-mongoengine. Improve MongoDB quickstart. * Fix Quickstart for SQLAlchemy with scoped session. * Login no longer, by default, checks for email deliverability. * Token authentication is no longer accepted on endpoints which only allow 'session' as authentication-method. (N247S) * /reset and /confirm and GENERIC_RESPONSES and additional form args don't mix. * Reset password can be exploited and other OWASP improvements. * Confirmation can be exploited and other OWASP improvements. * Convert to pyproject.toml, build, remove setup.py/.cfg. * the tf_validity feature now ONLY sets a cookie - and the token is no longer returned as part of a JSON response. * Fix login/unified signin templates to properly send CSRF token. Add more tests. * Improve Social Oauth example code. - 5.2.0: * Small updates to work with latest Flask/Werkzeug. * Drop support for Python 3.7 * Drop support for older versions of dependent packages (such as Flask). * Remove old Werkzeug compatibility check. * Compatibility with Quart. * Remove dependence on pkg_resources / setuptools (use importlib_resources package) * Fix tests to work with latest Werkzeug/Flask. Update requirements_low to match current releases. * Drop support for Python 3.7 - 5.1.2: * Hungarian translations not working. * Fix documentation for send_mail. (gg) * Fix for latest mongoengine and mongomock. * Fix inappropriate use of &thinsp& in French translations. (maxdup) * Improve documentation around subclassing forms. OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=31
2023-08-03 11:53:44 +00:00
BuildRequires: %{python_module wheel}
2020-04-05 08:37:47 +00:00
BuildRequires: %{python_module zxcvbn >= 4.4.28}
BuildRequires: fdupes
2020-04-05 08:37:47 +00:00
BuildRequires: python-rpm-macros
- Update to 5.3.0: * Improvements to recoverability and confirmation to align with OWASP best practices and reduce possible exploitation. * Webauthn Updates to handling of transport. * Fix MongoDB support by eliminating dependency on flask-mongoengine. Improve MongoDB quickstart. * Fix Quickstart for SQLAlchemy with scoped session. * Login no longer, by default, checks for email deliverability. * Token authentication is no longer accepted on endpoints which only allow 'session' as authentication-method. (N247S) * /reset and /confirm and GENERIC_RESPONSES and additional form args don't mix. * Reset password can be exploited and other OWASP improvements. * Confirmation can be exploited and other OWASP improvements. * Convert to pyproject.toml, build, remove setup.py/.cfg. * the tf_validity feature now ONLY sets a cookie - and the token is no longer returned as part of a JSON response. * Fix login/unified signin templates to properly send CSRF token. Add more tests. * Improve Social Oauth example code. - 5.2.0: * Small updates to work with latest Flask/Werkzeug. * Drop support for Python 3.7 * Drop support for older versions of dependent packages (such as Flask). * Remove old Werkzeug compatibility check. * Compatibility with Quart. * Remove dependence on pkg_resources / setuptools (use importlib_resources package) * Fix tests to work with latest Werkzeug/Flask. Update requirements_low to match current releases. * Drop support for Python 3.7 - 5.1.2: * Hungarian translations not working. * Fix documentation for send_mail. (gg) * Fix for latest mongoengine and mongomock. * Fix inappropriate use of &thinsp& in French translations. (maxdup) * Improve documentation around subclassing forms. OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=31
2023-08-03 11:53:44 +00:00
Requires: python-Flask >= 2.3.2
Requires: python-Flask-Babel >= 3.1.0
Requires: python-Flask-Login >= 0.6.2
Requires: python-Flask-Principal >= 0.4.0
- Update to 5.3.0: * Improvements to recoverability and confirmation to align with OWASP best practices and reduce possible exploitation. * Webauthn Updates to handling of transport. * Fix MongoDB support by eliminating dependency on flask-mongoengine. Improve MongoDB quickstart. * Fix Quickstart for SQLAlchemy with scoped session. * Login no longer, by default, checks for email deliverability. * Token authentication is no longer accepted on endpoints which only allow 'session' as authentication-method. (N247S) * /reset and /confirm and GENERIC_RESPONSES and additional form args don't mix. * Reset password can be exploited and other OWASP improvements. * Confirmation can be exploited and other OWASP improvements. * Convert to pyproject.toml, build, remove setup.py/.cfg. * the tf_validity feature now ONLY sets a cookie - and the token is no longer returned as part of a JSON response. * Fix login/unified signin templates to properly send CSRF token. Add more tests. * Improve Social Oauth example code. - 5.2.0: * Small updates to work with latest Flask/Werkzeug. * Drop support for Python 3.7 * Drop support for older versions of dependent packages (such as Flask). * Remove old Werkzeug compatibility check. * Compatibility with Quart. * Remove dependence on pkg_resources / setuptools (use importlib_resources package) * Fix tests to work with latest Werkzeug/Flask. Update requirements_low to match current releases. * Drop support for Python 3.7 - 5.1.2: * Hungarian translations not working. * Fix documentation for send_mail. (gg) * Fix for latest mongoengine and mongomock. * Fix inappropriate use of &thinsp& in French translations. (maxdup) * Improve documentation around subclassing forms. OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=31
2023-08-03 11:53:44 +00:00
Requires: python-Flask-WTF >= 1.1.1
Requires: python-MarkupSafe >= 2.1.0
- Update to 5.3.0: * Improvements to recoverability and confirmation to align with OWASP best practices and reduce possible exploitation. * Webauthn Updates to handling of transport. * Fix MongoDB support by eliminating dependency on flask-mongoengine. Improve MongoDB quickstart. * Fix Quickstart for SQLAlchemy with scoped session. * Login no longer, by default, checks for email deliverability. * Token authentication is no longer accepted on endpoints which only allow 'session' as authentication-method. (N247S) * /reset and /confirm and GENERIC_RESPONSES and additional form args don't mix. * Reset password can be exploited and other OWASP improvements. * Confirmation can be exploited and other OWASP improvements. * Convert to pyproject.toml, build, remove setup.py/.cfg. * the tf_validity feature now ONLY sets a cookie - and the token is no longer returned as part of a JSON response. * Fix login/unified signin templates to properly send CSRF token. Add more tests. * Improve Social Oauth example code. - 5.2.0: * Small updates to work with latest Flask/Werkzeug. * Drop support for Python 3.7 * Drop support for older versions of dependent packages (such as Flask). * Remove old Werkzeug compatibility check. * Compatibility with Quart. * Remove dependence on pkg_resources / setuptools (use importlib_resources package) * Fix tests to work with latest Werkzeug/Flask. Update requirements_low to match current releases. * Drop support for Python 3.7 - 5.1.2: * Hungarian translations not working. * Fix documentation for send_mail. (gg) * Fix for latest mongoengine and mongomock. * Fix inappropriate use of &thinsp& in French translations. (maxdup) * Improve documentation around subclassing forms. OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=31
2023-08-03 11:53:44 +00:00
Requires: python-WTForms >= 3.0.0
Requires: python-Werkzeug >= 2.3.3
Requires: python-bcrypt >= 4.0.1
- Update to 5.3.0: * Improvements to recoverability and confirmation to align with OWASP best practices and reduce possible exploitation. * Webauthn Updates to handling of transport. * Fix MongoDB support by eliminating dependency on flask-mongoengine. Improve MongoDB quickstart. * Fix Quickstart for SQLAlchemy with scoped session. * Login no longer, by default, checks for email deliverability. * Token authentication is no longer accepted on endpoints which only allow 'session' as authentication-method. (N247S) * /reset and /confirm and GENERIC_RESPONSES and additional form args don't mix. * Reset password can be exploited and other OWASP improvements. * Confirmation can be exploited and other OWASP improvements. * Convert to pyproject.toml, build, remove setup.py/.cfg. * the tf_validity feature now ONLY sets a cookie - and the token is no longer returned as part of a JSON response. * Fix login/unified signin templates to properly send CSRF token. Add more tests. * Improve Social Oauth example code. - 5.2.0: * Small updates to work with latest Flask/Werkzeug. * Drop support for Python 3.7 * Drop support for older versions of dependent packages (such as Flask). * Remove old Werkzeug compatibility check. * Compatibility with Quart. * Remove dependence on pkg_resources / setuptools (use importlib_resources package) * Fix tests to work with latest Werkzeug/Flask. Update requirements_low to match current releases. * Drop support for Python 3.7 - 5.1.2: * Hungarian translations not working. * Fix documentation for send_mail. (gg) * Fix for latest mongoengine and mongomock. * Fix inappropriate use of &thinsp& in French translations. (maxdup) * Improve documentation around subclassing forms. OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=31
2023-08-03 11:53:44 +00:00
Requires: python-bleach >= 6.0.0
Requires: python-cryptography >= 40.0.2
Requires: python-email-validator >= 2.0
- Update to 5.3.0: * Improvements to recoverability and confirmation to align with OWASP best practices and reduce possible exploitation. * Webauthn Updates to handling of transport. * Fix MongoDB support by eliminating dependency on flask-mongoengine. Improve MongoDB quickstart. * Fix Quickstart for SQLAlchemy with scoped session. * Login no longer, by default, checks for email deliverability. * Token authentication is no longer accepted on endpoints which only allow 'session' as authentication-method. (N247S) * /reset and /confirm and GENERIC_RESPONSES and additional form args don't mix. * Reset password can be exploited and other OWASP improvements. * Confirmation can be exploited and other OWASP improvements. * Convert to pyproject.toml, build, remove setup.py/.cfg. * the tf_validity feature now ONLY sets a cookie - and the token is no longer returned as part of a JSON response. * Fix login/unified signin templates to properly send CSRF token. Add more tests. * Improve Social Oauth example code. - 5.2.0: * Small updates to work with latest Flask/Werkzeug. * Drop support for Python 3.7 * Drop support for older versions of dependent packages (such as Flask). * Remove old Werkzeug compatibility check. * Compatibility with Quart. * Remove dependence on pkg_resources / setuptools (use importlib_resources package) * Fix tests to work with latest Werkzeug/Flask. Update requirements_low to match current releases. * Drop support for Python 3.7 - 5.1.2: * Hungarian translations not working. * Fix documentation for send_mail. (gg) * Fix for latest mongoengine and mongomock. * Fix inappropriate use of &thinsp& in French translations. (maxdup) * Improve documentation around subclassing forms. OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=31
2023-08-03 11:53:44 +00:00
Requires: python-importlib_resources >= 5.10.0
Requires: python-itsdangerous >= 1.1.0
- Update to 5.3.0: * Improvements to recoverability and confirmation to align with OWASP best practices and reduce possible exploitation. * Webauthn Updates to handling of transport. * Fix MongoDB support by eliminating dependency on flask-mongoengine. Improve MongoDB quickstart. * Fix Quickstart for SQLAlchemy with scoped session. * Login no longer, by default, checks for email deliverability. * Token authentication is no longer accepted on endpoints which only allow 'session' as authentication-method. (N247S) * /reset and /confirm and GENERIC_RESPONSES and additional form args don't mix. * Reset password can be exploited and other OWASP improvements. * Confirmation can be exploited and other OWASP improvements. * Convert to pyproject.toml, build, remove setup.py/.cfg. * the tf_validity feature now ONLY sets a cookie - and the token is no longer returned as part of a JSON response. * Fix login/unified signin templates to properly send CSRF token. Add more tests. * Improve Social Oauth example code. - 5.2.0: * Small updates to work with latest Flask/Werkzeug. * Drop support for Python 3.7 * Drop support for older versions of dependent packages (such as Flask). * Remove old Werkzeug compatibility check. * Compatibility with Quart. * Remove dependence on pkg_resources / setuptools (use importlib_resources package) * Fix tests to work with latest Werkzeug/Flask. Update requirements_low to match current releases. * Drop support for Python 3.7 - 5.1.2: * Hungarian translations not working. * Fix documentation for send_mail. (gg) * Fix for latest mongoengine and mongomock. * Fix inappropriate use of &thinsp& in French translations. (maxdup) * Improve documentation around subclassing forms. OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=31
2023-08-03 11:53:44 +00:00
Requires: python-passlib >= 1.7.4
Accepting request 801217 from home:alarrosa:branches:devel:languages:python:flask - Update to 3.4.2: * The flask-security repo was moved to a github organization Flask-Middleware. - Update to 3.4.1: * Fix a bunch of bugs in new unified sign in along with a couple other major issues. * (:issue:`298`) Alternative ID feature ran afoul of postgres/psycopg2 finickiness. * (:issue:`300`) JSON 401 responses had WWW-Authenticate Header attached - that caused browsers to pop up their own login/password form. Not what applications want. * (:issue:`280`) Allow admin/api to setup TFA (and unified sign in) out of band. Please see :meth:`.UserDatastore.tf_set`, :meth:`.UserDatastore.tf_reset`, :meth:`.UserDatastore.us_set`, :meth:`.UserDatastore.us_reset` and :meth:`.UserDatastore.reset_user_access`. * (:pr:`305`) We used form._errors which wasn't very pythonic, and it was removed in WTForms 2.3.0. * (:pr:`310`) WTForms 2.3.0 made email_validator optional, we need it. - Added Requires python-bcrypt and python-email_validator, Recommends python-PyQRCode, python-SQLAlchemy, python-zxcvbn and Suggests python-argon2_cffi and python-phonenumbers * (:pr:`257`) Support a unified sign in feature. Please see :ref:`unified-sign-in`. * (:pr:`265`) Add phone number validation class. This is used in both unified sign in as well as two-factor when using sms. * (:pr:`274`) Add support for 'freshness' of caller's authentication. This permits endpoints to be additionally protected by ensuring a OBS-URL: https://build.opensuse.org/request/show/801217 OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=5
2020-05-07 17:13:58 +00:00
Recommends: python-PyQRCode >= 1.2
- Update to 5.3.0: * Improvements to recoverability and confirmation to align with OWASP best practices and reduce possible exploitation. * Webauthn Updates to handling of transport. * Fix MongoDB support by eliminating dependency on flask-mongoengine. Improve MongoDB quickstart. * Fix Quickstart for SQLAlchemy with scoped session. * Login no longer, by default, checks for email deliverability. * Token authentication is no longer accepted on endpoints which only allow 'session' as authentication-method. (N247S) * /reset and /confirm and GENERIC_RESPONSES and additional form args don't mix. * Reset password can be exploited and other OWASP improvements. * Confirmation can be exploited and other OWASP improvements. * Convert to pyproject.toml, build, remove setup.py/.cfg. * the tf_validity feature now ONLY sets a cookie - and the token is no longer returned as part of a JSON response. * Fix login/unified signin templates to properly send CSRF token. Add more tests. * Improve Social Oauth example code. - 5.2.0: * Small updates to work with latest Flask/Werkzeug. * Drop support for Python 3.7 * Drop support for older versions of dependent packages (such as Flask). * Remove old Werkzeug compatibility check. * Compatibility with Quart. * Remove dependence on pkg_resources / setuptools (use importlib_resources package) * Fix tests to work with latest Werkzeug/Flask. Update requirements_low to match current releases. * Drop support for Python 3.7 - 5.1.2: * Hungarian translations not working. * Fix documentation for send_mail. (gg) * Fix for latest mongoengine and mongomock. * Fix inappropriate use of &thinsp& in French translations. (maxdup) * Improve documentation around subclassing forms. OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=31
2023-08-03 11:53:44 +00:00
Recommends: python-SQLAlchemy
Accepting request 801217 from home:alarrosa:branches:devel:languages:python:flask - Update to 3.4.2: * The flask-security repo was moved to a github organization Flask-Middleware. - Update to 3.4.1: * Fix a bunch of bugs in new unified sign in along with a couple other major issues. * (:issue:`298`) Alternative ID feature ran afoul of postgres/psycopg2 finickiness. * (:issue:`300`) JSON 401 responses had WWW-Authenticate Header attached - that caused browsers to pop up their own login/password form. Not what applications want. * (:issue:`280`) Allow admin/api to setup TFA (and unified sign in) out of band. Please see :meth:`.UserDatastore.tf_set`, :meth:`.UserDatastore.tf_reset`, :meth:`.UserDatastore.us_set`, :meth:`.UserDatastore.us_reset` and :meth:`.UserDatastore.reset_user_access`. * (:pr:`305`) We used form._errors which wasn't very pythonic, and it was removed in WTForms 2.3.0. * (:pr:`310`) WTForms 2.3.0 made email_validator optional, we need it. - Added Requires python-bcrypt and python-email_validator, Recommends python-PyQRCode, python-SQLAlchemy, python-zxcvbn and Suggests python-argon2_cffi and python-phonenumbers * (:pr:`257`) Support a unified sign in feature. Please see :ref:`unified-sign-in`. * (:pr:`265`) Add phone number validation class. This is used in both unified sign in as well as two-factor when using sms. * (:pr:`274`) Add support for 'freshness' of caller's authentication. This permits endpoints to be additionally protected by ensuring a OBS-URL: https://build.opensuse.org/request/show/801217 OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=5
2020-05-07 17:13:58 +00:00
Recommends: python-zxcvbn >= 4.4.28
- Update to 5.3.0: * Improvements to recoverability and confirmation to align with OWASP best practices and reduce possible exploitation. * Webauthn Updates to handling of transport. * Fix MongoDB support by eliminating dependency on flask-mongoengine. Improve MongoDB quickstart. * Fix Quickstart for SQLAlchemy with scoped session. * Login no longer, by default, checks for email deliverability. * Token authentication is no longer accepted on endpoints which only allow 'session' as authentication-method. (N247S) * /reset and /confirm and GENERIC_RESPONSES and additional form args don't mix. * Reset password can be exploited and other OWASP improvements. * Confirmation can be exploited and other OWASP improvements. * Convert to pyproject.toml, build, remove setup.py/.cfg. * the tf_validity feature now ONLY sets a cookie - and the token is no longer returned as part of a JSON response. * Fix login/unified signin templates to properly send CSRF token. Add more tests. * Improve Social Oauth example code. - 5.2.0: * Small updates to work with latest Flask/Werkzeug. * Drop support for Python 3.7 * Drop support for older versions of dependent packages (such as Flask). * Remove old Werkzeug compatibility check. * Compatibility with Quart. * Remove dependence on pkg_resources / setuptools (use importlib_resources package) * Fix tests to work with latest Werkzeug/Flask. Update requirements_low to match current releases. * Drop support for Python 3.7 - 5.1.2: * Hungarian translations not working. * Fix documentation for send_mail. (gg) * Fix for latest mongoengine and mongomock. * Fix inappropriate use of &thinsp& in French translations. (maxdup) * Improve documentation around subclassing forms. OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=31
2023-08-03 11:53:44 +00:00
Suggests: python-argon2_cffi >= 21.3.0
Suggests: python-phonenumbers
Conflicts: python-Flask-Security < 3.2.0
Obsoletes: python-Flask-Security < 3.2.0
Provides: python-Flask-Security = %{version}
BuildArch: noarch
%python_subpackages
%description
Flask-Security-Too is a Python module to add security features to a Flask
application. This is a independently maintained version of Flask-Security
based on the 3.0.0 version of the original.
%prep
- Update to 4.1.2: * default_reauthn_handler doesn't honor SECURITY_URL_PREFIX * Add public API and CLI command to change a user's password. * Add type hints. Please note that many of the packages that flask-security * Add first-class support for using username for signing in. * Possible open redirect vulnerability. * Improve cookie handling and default ``samesite`` to ``Strict``. * Email validation confusion - added documentation. * Add documentation on how to override specific error messages. * Don't install global-scope tests. * Add Blinker as explicit dependency, improve/fix celery usage docs, don't require pyqrcode unless authenticator configured, improve SMS configuration variables documentation. * Your UserModel must contain ``fs_uniquifier`` * Removal of python 2.7 and <3.6 support * Remove two-factor `/tf-confirm` endpoint and use generic `freshness` mechanism. * Remove ``SECURITY_BACKWARDS_COMPAT_AUTH_TOKEN_INVALID(ATE)``. In addition to not making sense - the documentation has never been correct. * Add 2FA Validity Window so an application can configure how often the second factor has to be entered. * Add HTML5 Email input types to email fields. - Refresh no-mongodb.patch - Drop patches: * no-setup-dependencies.patch * fix-dependencies.patch * 0001-Do-not-raise-a-TypeError-exception-if-phone.data-is-.patch - Add patch use-pyqrcodeng.patch: * Use pyqrcodeng rather than pyqrcode. OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=14
2022-02-28 06:21:54 +00:00
%autosetup -p1 -n Flask-Security-Too-%{version}
%if 0%{?suse_version} <= 1500
# test_trackable.py needs werkzeug.middleware.proxy_fix which is only available
# in newer werkzeug versions
rm tests/test_trackable.py
%endif
%build
- Update to 5.3.0: * Improvements to recoverability and confirmation to align with OWASP best practices and reduce possible exploitation. * Webauthn Updates to handling of transport. * Fix MongoDB support by eliminating dependency on flask-mongoengine. Improve MongoDB quickstart. * Fix Quickstart for SQLAlchemy with scoped session. * Login no longer, by default, checks for email deliverability. * Token authentication is no longer accepted on endpoints which only allow 'session' as authentication-method. (N247S) * /reset and /confirm and GENERIC_RESPONSES and additional form args don't mix. * Reset password can be exploited and other OWASP improvements. * Confirmation can be exploited and other OWASP improvements. * Convert to pyproject.toml, build, remove setup.py/.cfg. * the tf_validity feature now ONLY sets a cookie - and the token is no longer returned as part of a JSON response. * Fix login/unified signin templates to properly send CSRF token. Add more tests. * Improve Social Oauth example code. - 5.2.0: * Small updates to work with latest Flask/Werkzeug. * Drop support for Python 3.7 * Drop support for older versions of dependent packages (such as Flask). * Remove old Werkzeug compatibility check. * Compatibility with Quart. * Remove dependence on pkg_resources / setuptools (use importlib_resources package) * Fix tests to work with latest Werkzeug/Flask. Update requirements_low to match current releases. * Drop support for Python 3.7 - 5.1.2: * Hungarian translations not working. * Fix documentation for send_mail. (gg) * Fix for latest mongoengine and mongomock. * Fix inappropriate use of &thinsp& in French translations. (maxdup) * Improve documentation around subclassing forms. OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=31
2023-08-03 11:53:44 +00:00
%pyproject_wheel
%install
- Update to 5.3.0: * Improvements to recoverability and confirmation to align with OWASP best practices and reduce possible exploitation. * Webauthn Updates to handling of transport. * Fix MongoDB support by eliminating dependency on flask-mongoengine. Improve MongoDB quickstart. * Fix Quickstart for SQLAlchemy with scoped session. * Login no longer, by default, checks for email deliverability. * Token authentication is no longer accepted on endpoints which only allow 'session' as authentication-method. (N247S) * /reset and /confirm and GENERIC_RESPONSES and additional form args don't mix. * Reset password can be exploited and other OWASP improvements. * Confirmation can be exploited and other OWASP improvements. * Convert to pyproject.toml, build, remove setup.py/.cfg. * the tf_validity feature now ONLY sets a cookie - and the token is no longer returned as part of a JSON response. * Fix login/unified signin templates to properly send CSRF token. Add more tests. * Improve Social Oauth example code. - 5.2.0: * Small updates to work with latest Flask/Werkzeug. * Drop support for Python 3.7 * Drop support for older versions of dependent packages (such as Flask). * Remove old Werkzeug compatibility check. * Compatibility with Quart. * Remove dependence on pkg_resources / setuptools (use importlib_resources package) * Fix tests to work with latest Werkzeug/Flask. Update requirements_low to match current releases. * Drop support for Python 3.7 - 5.1.2: * Hungarian translations not working. * Fix documentation for send_mail. (gg) * Fix for latest mongoengine and mongomock. * Fix inappropriate use of &thinsp& in French translations. (maxdup) * Improve documentation around subclassing forms. OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=31
2023-08-03 11:53:44 +00:00
%pyproject_install
%python_expand %fdupes %{buildroot}%{$python_sitelib}
%check
- Update to 5.3.0: * Improvements to recoverability and confirmation to align with OWASP best practices and reduce possible exploitation. * Webauthn Updates to handling of transport. * Fix MongoDB support by eliminating dependency on flask-mongoengine. Improve MongoDB quickstart. * Fix Quickstart for SQLAlchemy with scoped session. * Login no longer, by default, checks for email deliverability. * Token authentication is no longer accepted on endpoints which only allow 'session' as authentication-method. (N247S) * /reset and /confirm and GENERIC_RESPONSES and additional form args don't mix. * Reset password can be exploited and other OWASP improvements. * Confirmation can be exploited and other OWASP improvements. * Convert to pyproject.toml, build, remove setup.py/.cfg. * the tf_validity feature now ONLY sets a cookie - and the token is no longer returned as part of a JSON response. * Fix login/unified signin templates to properly send CSRF token. Add more tests. * Improve Social Oauth example code. - 5.2.0: * Small updates to work with latest Flask/Werkzeug. * Drop support for Python 3.7 * Drop support for older versions of dependent packages (such as Flask). * Remove old Werkzeug compatibility check. * Compatibility with Quart. * Remove dependence on pkg_resources / setuptools (use importlib_resources package) * Fix tests to work with latest Werkzeug/Flask. Update requirements_low to match current releases. * Drop support for Python 3.7 - 5.1.2: * Hungarian translations not working. * Fix documentation for send_mail. (gg) * Fix for latest mongoengine and mongomock. * Fix inappropriate use of &thinsp& in French translations. (maxdup) * Improve documentation around subclassing forms. OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=31
2023-08-03 11:53:44 +00:00
%pytest -k 'not test_login_email_whatever'
%files %{python_files}
%doc AUTHORS CHANGES.rst README.rst
%license LICENSE
%{python_sitelib}/flask_security
%{python_sitelib}/Flask_Security_Too-%{version}.dist-info
%changelog