almet/ihatemoney
1
0
Fork 0
mirror of https://github.com/spiral-project/ihatemoney.git synced 2025-04-30 10:12:37 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions
A simple shared budget manager web application
806 commits 17 branches 26 tags 48 MiB
Python 74.3%
HTML 14.3%
CSS 6.1%
JavaScript 2.4%
Jinja 1.4%
Other 1.4%
Find a file
Baptiste Jonglez 8d77cf5d56 Fix unauthorized access and modification of project data (CVE-2020-15120) 
An authenticated member of one project can modify and delete members of
another project, without knowledge of this other project's private
code. This can be further exploited to access all bills of another project
without knowledge of this other project's private code.

With the default configuration, anybody is allowed to create a new
project. An attacker can create a new project and then use it to become
authenticated and exploit this flaw. As such, the exposure is similar to
an unauthenticated attack, because it is trivial to become authenticated.

This issue was caused by a wrong database queries in PersonQuery.

For more details, see https://github.com/spiral-project/ihatemoney/security/advisories/GHSA-67j9-c52g-w2q9
2020-07-26 19:21:16 +02:00
conf Misc small updates (#536) 2020-02-23 19:27:39 +01:00
docs Bump sphinx from 3.1.1 to 3.1.2 2020-07-18 00:42:07 +02:00
ihatemoney Fix unauthorized access and modification of project data (CVE-2020-15120) 2020-07-26 19:21:16 +02:00
.gitignore Feature/currencies (#541) 2020-04-29 22:57:08 +02:00
.isort.cfg Add isort support. (#561) 2020-04-21 13:59:41 +02:00
.travis.yml Remove obsolete python code (<3.6). (#571) 2020-04-24 12:32:52 +02:00
CHANGELOG.rst Add 'pt_BR' and 'ta' to default languages, update changelog 2020-07-18 01:05:22 +02:00
CONTRIBUTORS Integrate illustrations as a showcase (#544) 2020-05-07 22:34:31 +02:00
Dockerfile [docker] Download IHM from Pypy or reference git repo; 2019-07-31 13:02:03 +02:00
LICENSE Re-organize the documentation (#223) 2017-06-21 14:03:16 +02:00
Makefile Add isort support. (#561) 2020-04-21 13:59:41 +02:00
MANIFEST.in Update known working set. (#558) 2020-04-21 10:30:13 +02:00
README.rst Add weblate translation status to the README (#574) 2020-04-25 11:50:45 +02:00
setup.cfg Relax pin point dependencies (#660) 2020-07-26 18:21:55 +02:00
setup.py Remove support for python2. 2019-10-11 19:52:37 +02:00
tox.ini Remove obsolete python code (<3.6). (#571) 2020-04-24 12:32:52 +02:00

README.rst 

I hate money
############

.. image:: https://travis-ci.org/spiral-project/ihatemoney.svg?branch=master
   :target: https://travis-ci.org/spiral-project/ihatemoney
   :alt: Travis CI Build Status

.. image:: https://hosted.weblate.org/widgets/i-hate-money/-/i-hate-money/svg-badge.svg
   :target: https://hosted.weblate.org/engage/i-hate-money/?utm_source=widget
   :alt: Translation status from Weblate

*I hate money* is a web application made to ease shared budget management.
It keeps track of who bought what, when, and for whom; and helps to settle the
bills.

* `Online documentation <https://ihatemoney.readthedocs.org>`_
* `Hosted version <https://ihatemoney.org>`_
* `Mailing list <https://mailman.alwaysdata.com/postorius/lists/info.ihatemoney.org/>`_
  (to get updates when needed).

The code is distributed under a BSD *beerware* derivative: if you meet the
people in person and you want to pay them a craft beer, you are highly
encouraged to do so.

Requirements
============

* **Python**: 3.6, 3.7, 3.8.
* **Backends**: MySQL, PostgreSQL, SQLite, Memory.

Contributing
============

Do you wish to contribute to IHateMoney? Fantastic! There's a lot of very
useful help on the official `contributing
<https://ihatemoney.readthedocs.io/en/latest/contributing.html>`_ page.

Translation status
==================

.. image:: https://hosted.weblate.org/widgets/i-hate-money/-/i-hate-money/multi-blue.svg
   :target: https://hosted.weblate.org/engage/i-hate-money/?utm_source=widget
   :alt: Translation status for each language