Bug#928685: unblock: movim/0.14.1-5
Package: release.debian.org
Severity: normal
User: release.debian.org@packages.debian.org
Usertags: unblock
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Please unblock package movim
The attached debdiff fixes both an important (and mildly security-relevant
bug) in what directories the webserver in the default config grants access
too, and an upstream bug not tracked in Debian that breaks handling of
emojis in Jabber messages (displaying wrong wmojis to users).
unblock movim/0.14.1-5
- -- System Information:
Debian Release: 10.0
APT prefers unstable
APT policy: (500, 'unstable'), (500, 'stable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 4.19.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=nb_NO.UTF-8, LC_CTYPE=nb_NO.UTF-8 (charmap=UTF-8), LANGUAGE=nb_NO:nb:no_NO:no:nn_NO:nn:da:sv:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
-----BEGIN PGP SIGNATURE-----
iQKJBAEBCgBzFiEEPJ1UpHV1wCb7F/0mt5o8FqDE8pYFAlzTQLwxGmh0dHBzOi8v
d3d3LmRvbWluaWstZ2VvcmdlLmRlL2dwZy1wb2xpY3kudHh0LmFzYyMcZG9taW5p
ay5nZW9yZ2VAaXQucGlyYXRlbnBhcnRlaS5kZQAKCRC3mjwWoMTylgqZD/4tgi2n
KNfL/b3U1sjcqxy1irurI5ZEpR0Wk/2JtB+CbQ/g5fZXG4hxdDYxHgmpdyjYrHF+
sk4bU9EJ/XUn3GrKi0bBd5UiA3GJltGIkIs5bWikfktZA5czxRWNzHvj4T9BcSP2
/sUxvh0i67Vw3aKjCu14xNysWyHrezH85oVmIM/TpEDtE/Mu92kDJUmjxhk9zmgF
SnzyH3s6963LpXXCGGbfuYkdwt7LNCnbm/qdiCbQHGin+Hgt2qatpPP9h0H+3HAj
/yf3Re12tM5Z2YM/OeGeNCc/GaMXR+H11kAwTKe+1viAdAaQq7GxTi+KDn3ZUobE
oWVovzhsN7ve+5fJAwtMOsaZCrUyclyAK3HsWGa+51//ypQVtJztMxZJmf50g7Go
o4lUZ3Y+pzKbGyl1s1s8nosuYFr37hT3FnkHpWuFPPNn/vMljqQV3a5211bFpV34
PRWbV7OpWrxTWjuUS8YQUspozbrFRSZb8uz2jM2YxuZD2g0iGzJcyDGYxQd/XrMQ
0K31VY73cGKc6XQfnv2iKXz/y3viLaA/xCddaCsiXC9e+JbKgA8AXpsVn1UpBY6J
ajEO6eodV0VY8lpLUh7ha6Kv6N6bhNKkBuvIzcOYwRMjCJbtBmdUp3mMl3+KPsng
rPhLCMfG12/t26wAuFHECvd1IWYNPU5bZY8N8A==
=Dcb5
-----END PGP SIGNATURE-----
diff -Nru movim-0.14.1/debian/changelog movim-0.14.1/debian/changelog
--- movim-0.14.1/debian/changelog 2019-03-12 22:49:08.000000000 +0100
+++ movim-0.14.1/debian/changelog 2019-05-08 22:38:32.000000000 +0200
@@ -1,3 +1,13 @@
+movim (0.14.1-5) unstable; urgency=medium
+
+ [ Thorsten Glaser ]
+ * Add patch to fix emojis being replaced by the wrong images.
+
+ [ Dominik George ]
+ * Add patch to add correct ACLs to webserver configs. (Closes: #928209)
+
+ -- Dominik George <natureshadow@debian.org> Wed, 08 May 2019 22:38:32 +0200
+
movim (0.14.1-4) unstable; urgency=medium
* Restart movim daemon if it exits. (Closes: #924429)
diff -Nru movim-0.14.1/debian/patches/fix_928209.diff movim-0.14.1/debian/patches/fix_928209.diff
--- movim-0.14.1/debian/patches/fix_928209.diff 1970-01-01 01:00:00.000000000 +0100
+++ movim-0.14.1/debian/patches/fix_928209.diff 2019-05-08 22:37:41.000000000 +0200
@@ -0,0 +1,40 @@
+Subject: Fix ACLs in webserver configs.
+From: Dominik George <natureshadow@debian.org>
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=928209
+--- a/etc/apache2/conf-available/movim.conf
++++ b/etc/apache2/conf-available/movim.conf
+@@ -7,8 +7,19 @@ Alias /movim/ /usr/share/movim/
+ AllowOverride FileInfo Options
+ </Directory>
+
+-<Directory /var/lib/movim/cache/>
++<Directory /var/cache/movim>
+ Options -Indexes
++
++ <FilesMatch "\.jpg$">
++ Require all granted
++ </FilesMatch>
++ <FilesMatch ".$">
++ Require all denied
++ </FilesMatch>
++</Directory>
++
++<Directory /var/log/movim>
++ Require all denied
+ </Directory>
+
+ <Location /movim/>
+--- a/etc/nginx/conf.d/movim.conf
++++ b/etc/nginx/conf.d/movim.conf
+@@ -17,6 +17,10 @@ location /movim/ {
+ }
+
+ location /movim/cache/ {
+- deny all;
++ location ~ \.jpg$ {
++ }
++ location ~ . {
++ deny all;
++ }
+ }
+ }
diff -Nru movim-0.14.1/debian/patches/issue-835.diff movim-0.14.1/debian/patches/issue-835.diff
--- movim-0.14.1/debian/patches/issue-835.diff 1970-01-01 01:00:00.000000000 +0100
+++ movim-0.14.1/debian/patches/issue-835.diff 2019-05-08 22:27:33.000000000 +0200
@@ -0,0 +1,29 @@
+Description: fix upstream issue 835:
+ do not flag non-emojis as single emojis
+ (reduced patch to bare minimum to fix the bug)
+Bug: https://github.com/movim/movim/issues/835
+Forwarded: https://github.com/movim/movim/pull/837
+Author: mirabilos <thorsten.glaser@teckids.org>
+
+--- a/src/Movim/Emoji.php
++++ b/src/Movim/Emoji.php
+@@ -66,10 +66,9 @@ class Emoji
+ public function replace($string): string
+ {
+ $this->_string = $string;
++ $this->_lastEmoji = null;
+
+ return preg_replace_callback($this->_regex, function ($matches) {
+- $this->_lastEmoji = $matches[0];
+-
+ $astext = implode('-',
+ array_map('dechex',
+ unpack('N*', mb_convert_encoding($matches[0], 'UCS-4BE', 'UTF-8'))
+@@ -80,6 +79,7 @@ class Emoji
+ return $matches[0];
+ }
+
++ $this->_lastEmoji = $matches[0];
+ $this->_lastEmojiURL = BASE_URI . 'themes/' .
+ \App\Configuration::get()->theme .
+ '/img/emojis/svg/' . $astext . '.svg';
diff -Nru movim-0.14.1/debian/patches/series movim-0.14.1/debian/patches/series
--- movim-0.14.1/debian/patches/series 2019-03-12 22:49:08.000000000 +0100
+++ movim-0.14.1/debian/patches/series 2019-05-08 22:30:52.000000000 +0200
@@ -5,3 +5,5 @@
fix_924429.diff
fix_924431.diff
fix_924432.diff
+issue-835.diff
+fix_928209.diff
Reply to: