Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove CometVisu UI #2659

Closed
wants to merge 2 commits into from
Closed

Remove CometVisu UI #2659

wants to merge 2 commits into from

Conversation

kaikreuzer
Copy link
Member

Due the fact that it is no longer maintained and newer versions of CometVisu can use openHAB's REST API directly, we can remove this UI from the repo.

Signed-off-by: Kai Kreuzer <kai@openhab.org>
@kaikreuzer kaikreuzer added the enhancement New feature or request label Jul 9, 2024
@kaikreuzer kaikreuzer requested review from peuter and a team as code owners July 9, 2024 14:17
@peuter
Copy link
Member

peuter commented Jul 9, 2024

Why do you think it is no longer maintained? Did I miss something? There is just no requirement for changes here, that's why there aren't any. This is still needed by users who are using the cometvisu with openhabs built-in webserver. It adds a backend for cometvisus built-in maintenance features. Although we recommend using the official docker container to serve the cometvisu there are still users who do not do this. So please do not remove this.

@kaikreuzer
Copy link
Member Author

Sounds as if you had missed some notifications in the past months. Please have a look at
GHSA-v7gr-mqpj-wwh3
GHSA-3g4c-hjhr-73rj
GHSA-f729-58x4-gqgf
GHSA-pcwp-26pw-j98w

@rkoshak
Copy link

rkoshak commented Jul 9, 2024

Those security advisories are not public it appears so we can't seem them. That may not be a bad thing depending on the nature of the advisories but maybe we can get a quick summary or description that doesn't reveal too many details if the advisories cannot be made fully public?

In any case, if there are security problems with embedding ComitVisu with OH and there isn't going to be any fixes to those problems I agree that it should be removed despite the impact on some users. We cannot continue to distribute sofware with known security problems that will never get fixed.

@kaikreuzer
Copy link
Member Author

@rkoshak You are right, these advisories are in draft mode and thus only visible to repo maintainers so far.
They are all about the REST endpoints of the CometVisu, mainly typical weaknesses as listed by OWASP.

@peuter
Copy link
Member

peuter commented Jul 10, 2024

I haven't got any notification about those security problems, so I missed them all.
I will have at look at them ASAP.

@peuter
Copy link
Member

peuter commented Jul 14, 2024

I created #2671 that addresses the 4 listed security advisories (and some cleanup and minor stuff). Do I have to do anything with those security advisories, like add a comment how I tried to solve them, or anything else?

@kaikreuzer
Copy link
Member Author

add a comment how I tried to solve them, or anything else?

Yes, that would be great!
I'll close this PR as I've just merged #2671 - thanks for that!

@kaikreuzer kaikreuzer closed this Jul 17, 2024
@kaikreuzer kaikreuzer deleted the comet branch July 17, 2024 20:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants