Package: release.debian.org Severity: normal User: release.debian....@packages.debian.org Usertags: unblock
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Please unblock package movim The attached debdiff fixes both an important (and mildly security-relevant bug) in what directories the webserver in the default config grants access too, and an upstream bug not tracked in Debian that breaks handling of emojis in Jabber messages (displaying wrong wmojis to users). unblock movim/0.14.1-5 - -- System Information: Debian Release: 10.0 APT prefers unstable APT policy: (500, 'unstable'), (500, 'stable'), (1, 'experimental') Architecture: amd64 (x86_64) Kernel: Linux 4.19.0-4-amd64 (SMP w/4 CPU cores) Locale: LANG=nb_NO.UTF-8, LC_CTYPE=nb_NO.UTF-8 (charmap=UTF-8), LANGUAGE=nb_NO:nb:no_NO:no:nn_NO:nn:da:sv:en (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled -----BEGIN PGP SIGNATURE----- iQKJBAEBCgBzFiEEPJ1UpHV1wCb7F/0mt5o8FqDE8pYFAlzTQLwxGmh0dHBzOi8v d3d3LmRvbWluaWstZ2VvcmdlLmRlL2dwZy1wb2xpY3kudHh0LmFzYyMcZG9taW5p ay5nZW9yZ2VAaXQucGlyYXRlbnBhcnRlaS5kZQAKCRC3mjwWoMTylgqZD/4tgi2n KNfL/b3U1sjcqxy1irurI5ZEpR0Wk/2JtB+CbQ/g5fZXG4hxdDYxHgmpdyjYrHF+ sk4bU9EJ/XUn3GrKi0bBd5UiA3GJltGIkIs5bWikfktZA5czxRWNzHvj4T9BcSP2 /sUxvh0i67Vw3aKjCu14xNysWyHrezH85oVmIM/TpEDtE/Mu92kDJUmjxhk9zmgF SnzyH3s6963LpXXCGGbfuYkdwt7LNCnbm/qdiCbQHGin+Hgt2qatpPP9h0H+3HAj /yf3Re12tM5Z2YM/OeGeNCc/GaMXR+H11kAwTKe+1viAdAaQq7GxTi+KDn3ZUobE oWVovzhsN7ve+5fJAwtMOsaZCrUyclyAK3HsWGa+51//ypQVtJztMxZJmf50g7Go o4lUZ3Y+pzKbGyl1s1s8nosuYFr37hT3FnkHpWuFPPNn/vMljqQV3a5211bFpV34 PRWbV7OpWrxTWjuUS8YQUspozbrFRSZb8uz2jM2YxuZD2g0iGzJcyDGYxQd/XrMQ 0K31VY73cGKc6XQfnv2iKXz/y3viLaA/xCddaCsiXC9e+JbKgA8AXpsVn1UpBY6J ajEO6eodV0VY8lpLUh7ha6Kv6N6bhNKkBuvIzcOYwRMjCJbtBmdUp3mMl3+KPsng rPhLCMfG12/t26wAuFHECvd1IWYNPU5bZY8N8A== =Dcb5 -----END PGP SIGNATURE-----
diff -Nru movim-0.14.1/debian/changelog movim-0.14.1/debian/changelog --- movim-0.14.1/debian/changelog 2019-03-12 22:49:08.000000000 +0100 +++ movim-0.14.1/debian/changelog 2019-05-08 22:38:32.000000000 +0200 @@ -1,3 +1,13 @@ +movim (0.14.1-5) unstable; urgency=medium + + [ Thorsten Glaser ] + * Add patch to fix emojis being replaced by the wrong images. + + [ Dominik George ] + * Add patch to add correct ACLs to webserver configs. (Closes: #928209) + + -- Dominik George <naturesha...@debian.org> Wed, 08 May 2019 22:38:32 +0200 + movim (0.14.1-4) unstable; urgency=medium * Restart movim daemon if it exits. (Closes: #924429) diff -Nru movim-0.14.1/debian/patches/fix_928209.diff movim-0.14.1/debian/patches/fix_928209.diff --- movim-0.14.1/debian/patches/fix_928209.diff 1970-01-01 01:00:00.000000000 +0100 +++ movim-0.14.1/debian/patches/fix_928209.diff 2019-05-08 22:37:41.000000000 +0200 @@ -0,0 +1,40 @@ +Subject: Fix ACLs in webserver configs. +From: Dominik George <naturesha...@debian.org> +Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=928209 +--- a/etc/apache2/conf-available/movim.conf ++++ b/etc/apache2/conf-available/movim.conf +@@ -7,8 +7,19 @@ Alias /movim/ /usr/share/movim/ + AllowOverride FileInfo Options + </Directory> + +-<Directory /var/lib/movim/cache/> ++<Directory /var/cache/movim> + Options -Indexes ++ ++ <FilesMatch "\.jpg$"> ++ Require all granted ++ </FilesMatch> ++ <FilesMatch ".$"> ++ Require all denied ++ </FilesMatch> ++</Directory> ++ ++<Directory /var/log/movim> ++ Require all denied + </Directory> + + <Location /movim/> +--- a/etc/nginx/conf.d/movim.conf ++++ b/etc/nginx/conf.d/movim.conf +@@ -17,6 +17,10 @@ location /movim/ { + } + + location /movim/cache/ { +- deny all; ++ location ~ \.jpg$ { ++ } ++ location ~ . { ++ deny all; ++ } + } + } diff -Nru movim-0.14.1/debian/patches/issue-835.diff movim-0.14.1/debian/patches/issue-835.diff --- movim-0.14.1/debian/patches/issue-835.diff 1970-01-01 01:00:00.000000000 +0100 +++ movim-0.14.1/debian/patches/issue-835.diff 2019-05-08 22:27:33.000000000 +0200 @@ -0,0 +1,29 @@ +Description: fix upstream issue 835: + do not flag non-emojis as single emojis + (reduced patch to bare minimum to fix the bug) +Bug: https://github.com/movim/movim/issues/835 +Forwarded: https://github.com/movim/movim/pull/837 +Author: mirabilos <thorsten.gla...@teckids.org> + +--- a/src/Movim/Emoji.php ++++ b/src/Movim/Emoji.php +@@ -66,10 +66,9 @@ class Emoji + public function replace($string): string + { + $this->_string = $string; ++ $this->_lastEmoji = null; + + return preg_replace_callback($this->_regex, function ($matches) { +- $this->_lastEmoji = $matches[0]; +- + $astext = implode('-', + array_map('dechex', + unpack('N*', mb_convert_encoding($matches[0], 'UCS-4BE', 'UTF-8')) +@@ -80,6 +79,7 @@ class Emoji + return $matches[0]; + } + ++ $this->_lastEmoji = $matches[0]; + $this->_lastEmojiURL = BASE_URI . 'themes/' . + \App\Configuration::get()->theme . + '/img/emojis/svg/' . $astext . '.svg'; diff -Nru movim-0.14.1/debian/patches/series movim-0.14.1/debian/patches/series --- movim-0.14.1/debian/patches/series 2019-03-12 22:49:08.000000000 +0100 +++ movim-0.14.1/debian/patches/series 2019-05-08 22:30:52.000000000 +0200 @@ -5,3 +5,5 @@ fix_924429.diff fix_924431.diff fix_924432.diff +issue-835.diff +fix_928209.diff