hswaw
/
ldapweb
4
0
Fork 0
Code Issues 3 Pull Requests 1 Packages Projects Releases Wiki Activity
ldapweb/pyproject.toml

25 lines
431 B
TOML
Raw Normal View History

migrate to poetry
2023-09-19 19:28:35 +00:00
[tool.poetry]
name = "ldap-web"
version = "0.1.0"
description = ""
authors = []
readme = "README.md"
[tool.poetry.dependencies]
Fix build for Python 3.11
2023-09-19 20:14:09 +00:00
python = "~3.11"
deps: update flask to latest
2023-09-19 20:42:12 +00:00
Flask = "^2.3"
deps: update flask to v2 & almost everything else
2023-09-19 20:36:19 +00:00
Flask-WTF = "^1"
itsdangerous = "^2.0"
Jinja2 = "^3.0"
deps: update deps to latest minors
2023-09-19 20:20:48 +00:00
kerberos = "^1.3.0"
deps: update flask to v2 & almost everything else
2023-09-19 20:36:19 +00:00
MarkupSafe = "^2.0"
Implement LDAP avatar serving This adds a /avatar/<uid> endpoint which serves any jpegPhoto associated with a given user account. In true 'lol ldap' fashion, only `photo` and `jpegPhoto` fields are defined. The first one is for G3 photos (a fax format!). The latter is technically for JPEG. But we expect to abuse this and basically contain _any_ sensible photo format in there, as long as Python's PIL can parse it. The serving function always resamples images to a 256x256 PNG. This makes sure people don't leak EXIF and lets us depend on square avatars. This entire code assumes that it is safe to PIL.Image.open untrusted user data. My understanding is that it is, bar some DoS for very large images. We limit the potential for DoS by storing the images in LDAP, which I hope has some kind of field length limit... Oh, and this also adds a 'default avatar' functionality which serves simple generative mermaid art for any user who doesn't have an explicit avatar set. To prevent leaking the existence of users who don't have an avatar set, we serve such a generated avatar for all UIDs, including UIDs which don't exist.
2023-10-08 16:13:58 +00:00
pillow = "^10.0.1"
deps: update deps to latest minors
2023-09-19 20:20:48 +00:00
python-ldap = "^3.2.0"
Fix build for Python 3.11
2023-09-19 20:14:09 +00:00
uWSGI = "^2.0"
deps: update flask to v2 & almost everything else
2023-09-19 20:36:19 +00:00
Werkzeug = "^2.0"
deps: update flask to latest
2023-09-19 20:42:12 +00:00
WTForms = "^3"
migrate to poetry
2023-09-19 19:28:35 +00:00
[build-system]
requires = ["poetry-core"]
build-backend = "poetry.core.masonry.api"