)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":8648,"name":"Radomir Dopieralski","email":"openstack@dopieralski.pl","username":"thesheep"},"change_message_id":"501fdb9a884e3b574a90d5df10037c5ec2e5ae25","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Rework old customization templates and add new blocks"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"From Rocky we can now support Django\u0027s recurvive template"},{"line_number":10,"context_line":"importing. Let\u0027s move away from all these stand alone"},{"line_number":11,"context_line":"templates for deployers to override and instead direct them"},{"line_number":12,"context_line":"to overextend the existing templates and the blocks they"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"9f6a8fd7_5c61a904","line":9,"updated":"2018-04-20 09:12:09.000000000","message":"recursive","commit_id":"a67afee9a4631908dd552825267dc8e6851e176c"},{"author":{"_account_id":10420,"name":"Adrian Turjak","email":"devs+openstack@uncaught-exceptions.com","username":"adriant"},"change_message_id":"19d44f745a14f6f08c7462b4f579806d24b25c2f","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Rework old customization templates and add new blocks"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"From Rocky we can now support Django\u0027s recurvive template"},{"line_number":10,"context_line":"importing. Let\u0027s move away from all these stand alone"},{"line_number":11,"context_line":"templates for deployers to override and instead direct them"},{"line_number":12,"context_line":"to overextend the existing templates and the blocks they"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"9f6a8fd7_c697b944","line":9,"in_reply_to":"9f6a8fd7_5c61a904","updated":"2018-04-26 00:28:40.000000000","message":"bah! will fix that","commit_id":"a67afee9a4631908dd552825267dc8e6851e176c"}],"doc/source/configuration/customizing.rst":[{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"6b5029ae83c9f05b8cc4fb1c4d83f934f0547b73","unresolved":false,"context_lines":[{"line_number":35,"context_line":"same name as the template you wish to extend and only overriding the blocks you"},{"line_number":36,"context_line":"wish to change."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Your theme\u0027s ``base.html``::"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"    {% extends \"base.html\" %}"},{"line_number":41,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9f6a8fd7_c7b46af5","line":38,"range":{"start_line":38,"start_character":26,"end_line":38,"end_character":28},"updated":"2018-04-27 17:40:48.000000000","message":"We prefer to \".. code-block::\" rather than \"::\". Could you use code-block?","commit_id":"22bfa931a28297d653692bd229d41de909d71ebe"},{"author":{"_account_id":10420,"name":"Adrian Turjak","email":"devs+openstack@uncaught-exceptions.com","username":"adriant"},"change_message_id":"2ddcbc40a251b5971025884fa9bfd479e31f04d5","unresolved":false,"context_lines":[{"line_number":35,"context_line":"same name as the template you wish to extend and only overriding the blocks you"},{"line_number":36,"context_line":"wish to change."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Your theme\u0027s ``base.html``::"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"    {% extends \"base.html\" %}"},{"line_number":41,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5f7c97a3_44de6ada","line":38,"range":{"start_line":38,"start_character":26,"end_line":38,"end_character":28},"in_reply_to":"9f6a8fd7_c7b46af5","updated":"2018-05-15 05:56:20.000000000","message":"We can potentially clean that up later, but leaving as is for consistency because most of the code in these docs is still just \u0027::\u0027.","commit_id":"22bfa931a28297d653692bd229d41de909d71ebe"}],"openstack_dashboard/templates/base.html":[{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"d5a93b001a916347e5938eb6b4996c721a4a0565","unresolved":false,"context_lines":[{"line_number":7,"context_line":"  \u003chead\u003e"},{"line_number":8,"context_line":"    {% block analytics %}"},{"line_number":9,"context_line":"      {% include \"horizon/_analytics.html\" %}"},{"line_number":10,"context_line":"    {% endblock %}"},{"line_number":11,"context_line":"    \u003cmeta content\u003d\u0027IE\u003dedge\u0027 http-equiv\u003d\u0027X-UA-Compatible\u0027 /\u003e"},{"line_number":12,"context_line":"    \u003cmeta content\u003d\u0027text/html; charset\u003dutf-8\u0027 http-equiv\u003d\u0027Content-Type\u0027 /\u003e"},{"line_number":13,"context_line":"    \u003cmeta name\u003d\"viewport\" content\u003d\"width\u003ddevice-width, initial-scale\u003d1\"\u003e"}],"source_content_type":"text/html","patch_set":1,"id":"9f6a8fd7_b59dd75a","line":10,"updated":"2018-04-17 08:56:44.000000000","message":"We already have two templates for local customization: _custom_meta.html and _custom_head_js.html. You can override them by using themes. Personally I don\u0027t like an idea to have more templates for customization. Instead we should have a common single template for customization.","commit_id":"1941265e2bd28cb95804da52decc7e0e17bed490"},{"author":{"_account_id":10420,"name":"Adrian Turjak","email":"devs+openstack@uncaught-exceptions.com","username":"adriant"},"change_message_id":"b5b0d8cc8200bef9e10b37c741b5c40821a345ac","unresolved":false,"context_lines":[{"line_number":62,"context_line":"      \u003c/div\u003e"},{"line_number":63,"context_line":"    {% endblock %}"},{"line_number":64,"context_line":"    \u003cdiv id\u003d\"footer\"\u003e"},{"line_number":65,"context_line":"      {% block footer %}"},{"line_number":66,"context_line":"        {% include \"_footer.html\" %}"},{"line_number":67,"context_line":"      {% endblock %}"},{"line_number":68,"context_line":"    \u003c/div\u003e"},{"line_number":69,"context_line":"    {% block js %}"},{"line_number":70,"context_line":"      {% include \"horizon/_scripts.html\" %}"}],"source_content_type":"text/html","patch_set":3,"id":"9f6a8fd7_0e4b3bb0","line":67,"range":{"start_line":65,"start_character":6,"end_line":67,"end_character":20},"updated":"2018-04-18 04:02:34.000000000","message":"we can\u0027t exactly rename this to \u0027custom_footer\u0027 for consistency, but we can potentially wrap it with another block layer with that name. Then eventually remove the \u0027footer\u0027 block.\n\ne.g.:\n\n  {% block custom_footer %}\n    {% block footer %}\n       {% include \"_footer.html\" %}\n    {% endblock %}\n  {% endblock %}\n\nThat way people can still override the old one, but the new one will take precedent.","commit_id":"47c4da09f98e5dfe8b05a4e931aa2d638d460420"}],"releasenotes/notes/bp-less-customization-templates-30384e91c5565328.yaml":[{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"3ec5f67081650773c100ea475a651c5d4264083e","unresolved":false,"context_lines":[{"line_number":21,"context_line":"    ``custom_head_js`` block, or the now deprecated template"},{"line_number":22,"context_line":"    ``horizon/_custom_head_js.html`` for analytics tracking. Please read the"},{"line_number":23,"context_line":"    ``customizing`` docs and instead use the dedicated ``custom_analytics``"},{"line_number":24,"context_line":"    block."}],"source_content_type":"text/x-yaml","patch_set":10,"id":"5f7c97a3_582f2687","line":24,"updated":"2018-05-15 10:12:27.000000000","message":"This is \"security\" section. What kind of security issues do we have now? Could you explain more detail?","commit_id":"5d856f92cbaa120cd7c08d5cd2fec8b7fda7528c"},{"author":{"_account_id":10420,"name":"Adrian Turjak","email":"devs+openstack@uncaught-exceptions.com","username":"adriant"},"change_message_id":"8ad81d5e6ccf42dececde5ebf5274c34d8d6d09e","unresolved":false,"context_lines":[{"line_number":21,"context_line":"    ``custom_head_js`` block, or the now deprecated template"},{"line_number":22,"context_line":"    ``horizon/_custom_head_js.html`` for analytics tracking. Please read the"},{"line_number":23,"context_line":"    ``customizing`` docs and instead use the dedicated ``custom_analytics``"},{"line_number":24,"context_line":"    block."}],"source_content_type":"text/x-yaml","patch_set":10,"id":"5f7c97a3_8e15664b","line":24,"in_reply_to":"5f7c97a3_582f2687","updated":"2018-05-15 23:36:08.000000000","message":"This is a weird one to explain, but let me try.\n\nBasically, most people probably stick their tracking code in `_custom_head_js.html` and for one of the views I have in my Adjutant-ui plugins I can\u0027t have it tracked. The reason, it\u0027s a password reset view and the url itself is the code: `\u003chost\u003e/tokens/\u003csome_long_id\u003e`. We found that someone with access to the analytics, but not openstack, could watch the live data and potentially capture a password reset for a customer. This never actually happened, but it was a concern.\n\nSo for our custom theme we made this kind of a block in our `base.html` template which then the password reset view would override:\nhttps://github.com/openstack/adjutant-ui/blob/f8d53b3a12d1184e327d077bf4d6a6aed077e99f/adjutant_ui/content/token/templates/token/setpassword.html#L11-L12\n\nWith Adjutant potentially becoming an official project, that means OpenStack will have a potential password reset mechanism, and I need a more official way to \u0027turn off\u0027 analytics that may have been inserted by someone using horizon. If we make a dedicated block for it, and explain how to use it and why, then I have an easy place to override, and any other future views which shouldn\u0027t be tracked can do the same. Otherwise everyone deploying Adjutant has to make a `base.html` version with that block themselves which isn\u0027t as nice.","commit_id":"5d856f92cbaa120cd7c08d5cd2fec8b7fda7528c"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"870d005f58b32100f164ec6ee9886c818df9f56d","unresolved":false,"context_lines":[{"line_number":21,"context_line":"    ``custom_head_js`` block, or the now deprecated template"},{"line_number":22,"context_line":"    ``horizon/_custom_head_js.html`` for analytics tracking. Please read the"},{"line_number":23,"context_line":"    ``customizing`` docs and instead use the dedicated ``custom_analytics``"},{"line_number":24,"context_line":"    block."}],"source_content_type":"text/x-yaml","patch_set":10,"id":"5f7c97a3_e53522f8","line":24,"in_reply_to":"5f7c97a3_8e15664b","updated":"2018-06-24 20:58:03.000000000","message":"What I cannot understand yet is why and how the new way solves this issue you point out.\n\nAnother question is why Adjutant-ui plugin","commit_id":"5d856f92cbaa120cd7c08d5cd2fec8b7fda7528c"},{"author":{"_account_id":10420,"name":"Adrian Turjak","email":"devs+openstack@uncaught-exceptions.com","username":"adriant"},"change_message_id":"693476f43f14ffc69ae0b1e6d55dadb74b00c327","unresolved":false,"context_lines":[{"line_number":21,"context_line":"    ``custom_head_js`` block, or the now deprecated template"},{"line_number":22,"context_line":"    ``horizon/_custom_head_js.html`` for analytics tracking. Please read the"},{"line_number":23,"context_line":"    ``customizing`` docs and instead use the dedicated ``custom_analytics``"},{"line_number":24,"context_line":"    block."}],"source_content_type":"text/x-yaml","patch_set":10,"id":"5f7c97a3_533ff284","line":24,"in_reply_to":"5f7c97a3_e53522f8","updated":"2018-06-27 05:20:15.000000000","message":"The new way solves the issue by telling people to put their analytics code in a defined block specific to that, so that views/templates that do not want to be tracked can override that block and ensure no tracking is done. Yes if the block isn\u0027t used that doesn\u0027t solve anything, but this encourages a better practice. If they don\u0027t use the block, it is their problem, we\u0027ve done the best effort to encourage them not to.\n\nI\u0027m not sure what you mean by \"why adjutant-ui plugin\". It\u0027s a horizon plugin for Adjutant, a service that is currently under review for addition to OpenStack as an official service. Which has a view that should not be tracked, but there currently is no official way to turn tracking off on a per view basis.","commit_id":"5d856f92cbaa120cd7c08d5cd2fec8b7fda7528c"},{"author":{"_account_id":10420,"name":"Adrian Turjak","email":"devs+openstack@uncaught-exceptions.com","username":"adriant"},"change_message_id":"a337cf86e62623fc48d619f722640549860d5210","unresolved":false,"context_lines":[{"line_number":15,"context_line":"    * ``_login_form_footer.html``"},{"line_number":16,"context_line":"    * ``horizon/_custom_head_js.html``"},{"line_number":17,"context_line":"    * ``horizon/_custom_meta.html``"},{"line_number":18,"context_line":"security:"},{"line_number":19,"context_line":"  - |"},{"line_number":20,"context_line":"    For the security of your deployment and users, don\u0027t use the"},{"line_number":21,"context_line":"    ``custom_head_js`` block, or the now deprecated template"}],"source_content_type":"text/x-yaml","patch_set":16,"id":"5f7c97a3_4e5c974b","line":18,"range":{"start_line":18,"start_character":0,"end_line":18,"end_character":9},"updated":"2018-07-17 02:00:27.000000000","message":"Can potentially just call this \u0027upgrade\u0027.","commit_id":"e315b4c0dcc5312725d826ebed14f0084f11367c"},{"author":{"_account_id":1736,"name":"Ivan Kolodyazhny","email":"e0ne@e0ne.info","username":"e0ne"},"change_message_id":"0603d74caf30ab5913d559cce0cadf92a7390438","unresolved":false,"context_lines":[{"line_number":17,"context_line":"    * ``horizon/_custom_meta.html``"},{"line_number":18,"context_line":"upgrade:"},{"line_number":19,"context_line":"  - |"},{"line_number":20,"context_line":"    For the security of your deployment and users, don\u0027t use the"},{"line_number":21,"context_line":"    ``custom_head_js`` block, or the now deprecated template"},{"line_number":22,"context_line":"    ``horizon/_custom_head_js.html`` for analytics tracking. Please read the"},{"line_number":23,"context_line":"    ``customizing`` docs and instead use the dedicated ``custom_analytics``"}],"source_content_type":"text/x-yaml","patch_set":17,"id":"5f7c97a3_c0cf4252","line":20,"range":{"start_line":20,"start_character":4,"end_line":20,"end_character":50},"updated":"2018-07-25 18:03:01.000000000","message":"If there is no security impact we don\u0027t need to mention it","commit_id":"afd54f0954541ebccaafb68a86906179b32baf93"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"d5b01b735a3aadfb4f6300d0011705c12644f391","unresolved":false,"context_lines":[{"line_number":17,"context_line":"    * ``horizon/_custom_meta.html``"},{"line_number":18,"context_line":"upgrade:"},{"line_number":19,"context_line":"  - |"},{"line_number":20,"context_line":"    For the security of your deployment and users, don\u0027t use the"},{"line_number":21,"context_line":"    ``custom_head_js`` block, or the now deprecated template"},{"line_number":22,"context_line":"    ``horizon/_custom_head_js.html`` for analytics tracking. Please read the"},{"line_number":23,"context_line":"    ``customizing`` docs and instead use the dedicated ``custom_analytics``"}],"source_content_type":"text/x-yaml","patch_set":17,"id":"3f79a3b5_a8fc1cb5","line":20,"range":{"start_line":20,"start_character":4,"end_line":20,"end_character":50},"in_reply_to":"5f7c97a3_c0cf4252","updated":"2018-08-13 08:54:50.000000000","message":"Agree with Ivan. I followed the discussion so far again, but I still cannot understand what is your concern. You referred to adjutant-ui but the scenario seems to be caused by the way of adjutant-ui implementation. If operators use custom templates, they need to be careful to avoid security risk. I think this is same even after the new customization model.\n\nAvoiding potential security risks would be nice, but I am not sure why and how the new template model prevents it.","commit_id":"afd54f0954541ebccaafb68a86906179b32baf93"}]}