almet/ihatemoney
1
0
Fork 0
mirror of https://github.com/spiral-project/ihatemoney.git synced 2025-05-01 10:42:24 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions
A simple shared budget manager web application
694 commits 17 branches 26 tags 48 MiB
Python 74.3%
HTML 14.3%
CSS 6.1%
JavaScript 2.4%
Jinja 1.4%
Other 1.4%
Find a file
Baptiste Jonglez 9aef13b50c Fix unauthorized access and modification of project data (CVE-2020-15120) 
An authenticated member of one project can modify and delete members of
another project, without knowledge of this other project's private
code. This can be further exploited to access all bills of another project
without knowledge of this other project's private code.

With the default configuration, anybody is allowed to create a new
project. An attacker can create a new project and then use it to become
authenticated and exploit this flaw. As such, the exposure is similar to
an unauthenticated attack, because it is trivial to become authenticated.

This issue was caused by a wrong database queries in PersonQuery.

For more details, see https://github.com/spiral-project/ihatemoney/security/advisories/GHSA-67j9-c52g-w2q9

(cherry picked from commit 8d77cf5d56)
2020-07-26 19:34:23 +02:00
conf [docker] Download IHM from Pypy or reference git repo; 2019-07-31 13:02:03 +02:00
docs Pin dependencies to ensure that pip will use the exact version of deps 2020-06-07 21:22:48 +02:00
ihatemoney Fix unauthorized access and modification of project data (CVE-2020-15120) 2020-07-26 19:34:23 +02:00
.gitignore Add python 3.6 support (#259) 2017-08-20 12:21:59 +02:00
.travis.yml remove compatibility of py34 2019-09-08 19:14:43 +02:00
CHANGELOG.rst Update 4.1.5 changelog 2020-07-26 18:39:06 +02:00
CONTRIBUTORS Update the CONTRIBUTORS file 2019-09-07 00:06:06 +02:00
Dockerfile [docker] Download IHM from Pypy or reference git repo; 2019-07-31 13:02:03 +02:00
LICENSE Re-organize the documentation (#223) 2017-06-21 14:03:16 +02:00
Makefile Pin dependencies to ensure that pip will use the exact version of deps 2020-06-07 21:22:48 +02:00
MANIFEST.in Pin dependencies to ensure that pip will use the exact version of deps 2020-06-07 21:22:48 +02:00
README.rst Update translations to publish new point release. 2019-09-18 21:40:09 +02:00
setup.py Back to development: 4.1.5 2020-06-15 22:58:22 +02:00
tox.ini Pin dependencies to ensure that pip will use the exact version of deps 2020-06-07 21:22:48 +02:00

README.rst 

I hate money
############

.. image:: https://travis-ci.org/spiral-project/ihatemoney.svg?branch=master
   :target: https://travis-ci.org/spiral-project/ihatemoney
   :alt: Travis CI Build Status

*I hate money* is a web application made to ease shared budget management.
It keeps track of who bought what, when, and for whom; and helps to settle the
bills.

* `Online documentation <https://ihatemoney.readthedocs.org>`_
* `Hosted version <https://ihatemoney.org>`_
* `Mailing list <https://mailman.alwaysdata.com/postorius/lists/info.ihatemoney.org/>`_
  (to get updates when needed).

The code is distributed under a BSD *beerware* derivative: if you meet the
people in person and you want to pay them a craft beer, you are highly
encouraged to do so.

Requirements
============

* **Python**: 2.7, 3.5, 3.6, 3.7.
* **Backends**: MySQL, PostgreSQL, SQLite, Memory.

Contributing
============

Do you wish to contribute to IHateMoney? Fantastic! There's a lot of very
useful help on the official `contributing
<https://ihatemoney.readthedocs.io/en/latest/contributing.html>`_ page.