Skip to content

Commit af2f7fc

Browse files
MaffoochDefectDojo release botrossopscoheigeapaulOsinski
authored
Release: Merge back 2.56.3 into dev from: master-into-dev/2.56.3-2.57.0-dev (#14580)
* Update versions in application files * Exclude async_user from celery task (#14506) * [doc] various updates (#14484) * implement lychee * pass unit tests * update contribution guidelines for docs * [doc] close_old_findings diff between import types * remove usage docs from open_source/archive * move docs archive up a folder * rules engine is pro only * create a single notification_webhooks article * mv remaining open_source articles * chore: normalize line endings to LF per .gitattributes * fix links * remove redundant upgrade file * Merge pull request #14551 from dogboat/drop-system-settings-credentials Drop System_Settings "credentials" field * Change dependabot and renovate to weekly on Wednesdays (#14552) * Change dependabot and renovate schedules from daily to weekly on Wednesdays Reduces noise from dependency update PRs by limiting both dependabot and renovate to run once per week on Wednesdays instead of daily. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Pin Hugo version and prevent automated update PRs Remove Renovate annotations from Hugo version lines in workflow files and add gohugoio/hugo to ignoreDeps in renovate.json to prevent Dependabot/Renovate from opening PRs to bump the Hugo version. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Fix import-languages 500 errors and optimize DB performance (#14553) * Fix import-languages endpoint 500 errors and optimize performance The /api/v2/import-languages/ endpoint was producing 500 errors due to database integrity issues on Language_Type and Languages models. This commit addresses both reliability and performance. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Fix ruff lint errors in serializer and migration Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Consolidate two migrations into single 0262_language_type_unique_language Combines the data deduplication (RunPython) and schema change (AlterField) into a single migration file. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Fix test fixtures conflicting with Language_Type unique constraint Remove Language_Type entries from test fixtures that duplicate languages already seeded by migration 0115_language_types. Update Languages FK references to point to the correct seeded Language_Type PKs. - dojo_testdata.json: Remove JSON (pk=1) and Python (pk=2) Language_Type entries, update Languages FK from pk=1 to pk=94 (seeded JSON pk) - dojo_testdata_locations.json: Same changes - defect_dojo_sample_data.json: Remove 3 conflicting Language_Type entries (DOS Batch, InstallShield, Ruby) with PKs that differ from seed data - defect_dojo_sample_data_locations.json: Same changes Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Renumber migration from 0262 to 0263 to avoid conflict Migration 0262_remove_system_settings_credentials was merged to the bugfix branch. Renumber our migration to 0263 and update the dependency chain and max_migration.txt accordingly. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * Extended migration steps for PostgreSQL data (#14561) Extended migration steps for PostgreSQL data after upgrading to 2.55.4. * Fix deterministic ordering for async_dupe_delete when duplicate dates tie (#14562) * fix: deterministic order when deleting excess duplicate findings order_by("date") does not define order for rows with identical dates. Add id as secondary sort so async_dupe_delete removes oldest duplicates first (by date, then id), matching documented behavior. * test: cover async_dupe_delete ordering when duplicate dates match Add test_delete_duplicate_order_same_date_tiebreak_by_id; lower-id duplicate is removed first when max_dupes is exceeded and date ties. * Parse Twistlock packagePath so that we can record where the CVE is found (#14549) * Update versions in application files * Update versions in application files --------- Co-authored-by: DefectDojo release bot <dojo-release-bot@users.noreply.github.com> Co-authored-by: Ross E Esposito <ross@defectdojo.com> Co-authored-by: Colm O hEigeartaigh <coheigea@users.noreply.github.com> Co-authored-by: Paul Osinski <42211303+paulOsinski@users.noreply.github.com> Co-authored-by: dogboat <dogboat@users.noreply.github.com> Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Stephan Pillhofer <43667664+DarkR0ast@users.noreply.github.com> Co-authored-by: valentijnscholten <valentijnscholten@gmail.com>
2 parents 7280e43 + 75265bb commit af2f7fc

64 files changed

Lines changed: 1097 additions & 1656 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/dependabot.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,8 @@ updates:
33
- package-ecosystem: pip
44
directory: "/"
55
schedule:
6-
interval: daily
6+
interval: weekly
7+
day: wednesday
78
time: "08:00"
89
open-pull-requests-limit: 10
910
target-branch: dev
@@ -17,7 +18,8 @@ updates:
1718
- package-ecosystem: npm
1819
directory: "/components"
1920
schedule:
20-
interval: daily
21+
interval: weekly
22+
day: wednesday
2123
time: "08:00"
2224
open-pull-requests-limit: 10
2325
target-branch: dev

‎.github/renovate.json‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
{
22
"extends": [
3-
"config:recommended"
3+
"config:recommended",
4+
"schedule:weekly"
45
],
6+
"schedule": ["* * * * 3"],
57
"dependencyDashboard": true,
68
"dependencyDashboardApproval": false,
79
"baseBranchPatterns": ["dev"],
@@ -16,7 +18,7 @@
1618
"dojo/components/yarn.lock",
1719
"dojo/components/package.json"
1820
],
19-
"ignoreDeps": [],
21+
"ignoreDeps": ["gohugoio/hugo"],
2022
"packageRules": [{
2123
"matchPackageNames": ["*"],
2224
"commitMessageExtra": "from {{currentVersion}} to {{#if isMajor}}v{{{newMajor}}}{{else}}{{#if isSingleVersion}}v{{{newVersion}}}{{else}}{{{newValue}}}{{/if}}{{/if}}",

‎.github/workflows/gh-pages.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
- name: Setup Hugo
1919
uses: peaceiris/actions-hugo@75d2e84710de30f6ff7268e08f310b60ef14033f # v3.0.0
2020
with:
21-
hugo-version: '0.153.4' # renovate: datasource=github-releases depName=gohugoio/hugo
21+
hugo-version: '0.153.4'
2222
extended: true
2323

2424
- name: Setup Node

‎.github/workflows/validate_docs_build.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
- name: Setup Hugo
1414
uses: peaceiris/actions-hugo@75d2e84710de30f6ff7268e08f310b60ef14033f # v3.0.0
1515
with:
16-
hugo-version: '0.153.4' # renovate: datasource=github-releases depName=gohugoio/hugo
16+
hugo-version: '0.153.4'
1717
extended: true
1818

1919
- name: Setup Node

‎docs/content/admin/notifications/about_notifications.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,4 +75,4 @@ For more information about this behavior see the [related pull request #9699](ht
7575

7676
### Webhooks (experimental)
7777

78-
DefectDojo also supports webhooks that follow the same events as other notifications (you can be notified in the same situations). Details about setup are described in [related page](/open_source/notification_webhooks/how_to).
78+
DefectDojo also supports webhooks that follow the same events as other notifications (you can be notified in the same situations). Details about setup are described in [the related page](/automation/api/notification_webhooks/).

‎docs/content/admin/sso/OS__ldap.md‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
---
2+
title: "LDAP Authentication"
3+
description: "Authenticate users via LDAP by building custom Docker images"
4+
weight: 20
5+
audience: opensource
6+
aliases:
7+
- /en/open_source/ldap-authentication
8+
---
9+
10+
**This feature is experimental, and is not implemented in DefectDojo Pro**.
11+
12+
DefectDojo does not support LDAP authentication out of the box. However, since DefectDojo is built on Django, LDAP can be added by building your own Docker images and modifying a small number of configuration files.
13+
14+
## Files to Modify
15+
16+
- `Dockerfile.django-*`
17+
- `Dockerfile.nginx-*`
18+
- `requirements.txt`
19+
- `local_settings.py`
20+
- `docker-compose.yml` *(optional — for passing secrets via environment variables)*
21+
22+
## Dockerfile Modifications
23+
24+
In both `Dockerfile.django-alpine` and `Dockerfile.nginx-alpine`, add the following to the `apk add` layer:
25+
26+
```bash
27+
openldap-dev \
28+
cyrus-sasl-dev \
29+
```
30+
31+
In `Dockerfile.django-debian`, add the following to the `apt-get install` layer:
32+
33+
```bash
34+
libldap2-dev \
35+
libsasl2-dev \
36+
ldap-utils \
37+
```
38+
39+
## requirements.txt
40+
41+
Check [pypi.org](https://pypi.org) for the latest versions at the time of implementation, then add:
42+
43+
```
44+
python-ldap==3.4.5
45+
django-auth-ldap==5.2.0
46+
```
47+
48+
- [python-ldap](https://pypi.org/project/python-ldap/)
49+
- [django-auth-ldap](https://pypi.org/project/django-auth-ldap/)
50+
51+
## local_settings.py
52+
53+
Find the settings file (see `/dojo/settings/settings.py` for instructions on using `local_settings.py`) and make the following additions.
54+
55+
At the top of the file:
56+
57+
```python
58+
import ldap
59+
from django_auth_ldap.config import LDAPSearch, GroupOfNamesType
60+
import environ
61+
```
62+
63+
Add LDAP variables to the `env` dict:
64+
65+
```python
66+
# LDAP
67+
env = environ.FileAwareEnv(
68+
DD_LDAP_SERVER_URI=(str, 'ldap://ldap.example.com'),
69+
DD_LDAP_BIND_DN=(str, ''),
70+
DD_LDAP_BIND_PASSWORD=(str, ''),
71+
)
72+
```
73+
74+
Then add the LDAP settings beneath the `env` dict:
75+
76+
```python
77+
AUTH_LDAP_SERVER_URI = env('DD_LDAP_SERVER_URI')
78+
AUTH_LDAP_BIND_DN = env('DD_LDAP_BIND_DN')
79+
AUTH_LDAP_BIND_PASSWORD = env('DD_LDAP_BIND_PASSWORD')
80+
81+
AUTH_LDAP_USER_SEARCH = LDAPSearch(
82+
"ou=Groups,dc=example,dc=com", ldap.SCOPE_SUBTREE, "(uid=%(user)s)"
83+
)
84+
85+
AUTH_LDAP_USER_ATTR_MAP = {
86+
"first_name": "givenName",
87+
"last_name": "sn",
88+
"email": "mail",
89+
}
90+
```
91+
92+
Customise all search variables to match your organisation's LDAP configuration.
93+
94+
### Optional: Group Controls
95+
96+
```python
97+
AUTH_LDAP_GROUP_SEARCH = LDAPSearch(
98+
"dc=example,dc=com",
99+
ldap.SCOPE_SUBTREE,
100+
"(objectClass=groupOfNames)",
101+
)
102+
AUTH_LDAP_GROUP_TYPE = GroupOfNamesType(name_attr="cn")
103+
104+
AUTH_LDAP_REQUIRE_GROUP = "cn=DD_USER_ACTIVE,ou=Groups,dc=example,dc=com"
105+
106+
AUTH_LDAP_USER_FLAGS_BY_GROUP = {
107+
"is_active": "cn=DD_USER_ACTIVE,ou=Groups,dc=example,dc=com",
108+
"is_staff": "cn=DD_USER_STAFF,ou=Groups,dc=example,dc=com",
109+
"is_superuser": "cn=DD_USER_ADMIN,ou=Groups,dc=example,dc=com",
110+
}
111+
```
112+
113+
Finally, add `django_auth_ldap.backend.LDAPBackend` to `AUTHENTICATION_BACKENDS`:
114+
115+
```python
116+
AUTHENTICATION_BACKENDS = (
117+
'django_auth_ldap.backend.LDAPBackend',
118+
'django.contrib.auth.backends.RemoteUserBackend',
119+
'django.contrib.auth.backends.ModelBackend',
120+
)
121+
```
122+
123+
Full documentation: [Django Authentication with LDAP](https://django-auth-ldap.readthedocs.io/en/latest/)
124+
125+
## docker-compose.yml
126+
127+
To pass LDAP credentials to the container via environment variables, add these to the `uwsgi` service environment section:
128+
129+
```yaml
130+
DD_LDAP_SERVER_URI: "${DD_LDAP_SERVER_URI:-ldap://ldap.example.com}"
131+
DD_LDAP_BIND_DN: "${DD_LDAP_BIND_DN:-}"
132+
DD_LDAP_BIND_PASSWORD: "${DD_LDAP_BIND_PASSWORD:-}"
133+
```
134+
135+
Alternatively, set these values directly in `local_settings.py`.

‎docs/content/admin/user_management/set_user_permissions.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ Configuration Permissions are not related to a specific Product or Product Type
120120
* **Finding Templates:** Access to the Findings \> Finding Templates page
121121
* **Groups**: Access the 👤Users \> Groups page
122122
* **Jira Instances:** Access the ⚙️Configuration \> JIRA page
123-
* **Language Types**:Access the [Language Types](/open_source/languages/) API endpoint
123+
* **Language Types**:Access the [Language Types](/automation/api/languages/) API endpoint
124124
* **Login Banner**: Edit the ⚙️Configuration \> Login Banner page
125125
* **Announcements**: Access ⚙️Configuration \> Announcements
126126
* **Note Types:** Access the ⚙️Configuration \> Note Types page

docs/content/open_source/archived_docs/_index.md renamed to docs/content/archived_docs/_index.md

File renamed without changes.

docs/content/open_source/archived_docs/burp-plugin.md renamed to docs/content/archived_docs/burp-plugin.md

File renamed without changes.

docs/content/open_source/archived_docs/google-sheets-sync.md renamed to docs/content/archived_docs/google-sheets-sync.md

File renamed without changes.

0 commit comments

Comments
 (0)