--- rpms/phpki-ng/contribs10/phpki-ng.spec	2021/09/30 16:31:50	1.13
+++ rpms/phpki-ng/contribs10/phpki-ng.spec	2022/12/14 21:52:41	1.16
@@ -4,7 +4,7 @@
 
 %define 	name phpki-ng
 %define 	version 0.84
-%define 	release 12
+%define 	release 15
 Summary: 	Phpki is a simple certificate management suite
 Name: 		%{name}
 Version: 	%{version}
@@ -22,7 +22,8 @@ Patch5:         phpki-ng-0.84-fix-html-d
 Patch6:         phpki-ng-0.84-fix-download-cert.patch
 Patch7:         phpki-ng-0.84-fix-html-syntax-in-help.patch
 Patch8:         phpki-ng-0.84-fix-final-redirect.patch
-
+Patch9:		phpki-ng-bz12272-bz12273-crl-whitespacepass.patch
+Patch10:	phpki-ng-bz12274-regex-secu.patch
 
 BuildArch: 	noarch
 BuildRoot: 	/var/tmp/%{name}-%{version}
@@ -45,6 +46,18 @@ With it, you may create and centrally ma
 e-mail clients, SSL servers, and VPN applications.
 
 %changelog
+* Wed Dec 14 2022 Jean-Philippe Pialasse <tests@pialasse.com> 0.84-15.sme
+- fix regex and potential code injection [SME: 12274]
+
+* Wed Dec 14 2022 Jean-Philippe Pialasse <tests@pialasse.com> 0.84-14.sme
+- add easy and safe access to crl download [SME: 12272]
+- fix revoke certificate failing on whitespace pass [SME: 12273]
+- fix missing default_md in config.php from previous versions [SME: 12267]
+- updated scriptlet to ease backup and restore
+
+* Fri Nov 18 2022 Jean-Philippe Pialasse <tests@pialasse.com> 0.84-13.sme
+- remove extra space in URL in search.php [SME: 12232]
+
 * Thu Sep 30 2021 John Crisp <jcrisp@safeandsoundit.co.uk> 0.84-12.sme
 - Attempt to fix the final reload after CA creation [SME: 11192]
 
@@ -207,6 +220,8 @@ e-mail clients, SSL servers, and VPN app
 %patch6 -p1
 %patch7 -p1
 %patch8 -p1
+%patch9 -p1
+%patch10 -p1
 
 %build
 %{__mkdir_p} root/opt/phpki/html
@@ -264,6 +279,11 @@ echo "**********************************
 echo "*  This contrib now has higher levels of encryption"
 echo "* "
 echo "*  We cannot upgrade your existing certificates"
+echo "* existing certificates from SME9 or below have either "
+echo "* md5WithRSAEncryption sha1WithRSAEncryption"
+echo "* as Signature Algorithm (weak)."
+echo "* only way to update to sha256 or sha512 is to "
+echo "* start from scratch."
 echo "* "
 echo "*  If you have existing certificates you want to use"
 echo "*  then start with a new CA, backup up, and then restore"
@@ -274,21 +294,33 @@ echo ""
 
 if [ -d /opt/phpki/phpki-store ] ; then
     echo "Backing up your /opt/phpki/phpki-store"
-    RANDOM=$$
-    PHPKIDIR=$(( 1 + $RANDOM%99999 ))
-    echo "Number is $PHPKIDIR"
-    echo "Copying from /opt/phpki/phpki-store to /opt/phpki/phpki-store.$PHPKIDIR"
-    /bin/cp -pr /opt/phpki/phpki-store "/opt/phpki/phpki-store.$PHPKIDIR"
-    echo "Directory copied...continuing installaton"
+    today=$(date "+%Y%m%d%H%M")
+    echo "Copying from /opt/phpki/phpki-store to /opt/phpki/phpki-store.$today"
+    /bin/cp -pr /opt/phpki/phpki-store "/opt/phpki/phpki-store.$today"
+    echo "Directory copied... continuing to install"
+    # fix missing md_default
+    if ( grep default_md /opt/phpki/phpki-store/config/config.php -q ); then
+      echo "md_default OK"
+    else
+      echo "default_md missing in /opt/phpki/phpki-store/config/config.php"
+      echo "getting  value from /opt/phpki/phpki-store/config/openssl.cnf"
+      # it could ba acceptable to hash sha256 a certificate from a root with sha1. 
+      defaultmd=$(awk '/^default_md/{print $NF}' /opt/phpki/phpki-store/config/openssl.cnf || echo "sha512")
+      echo "inserting $defaultmd default_md at end of /opt/phpki/phpki-store/config/config.php"
+      sed -i '/\?>/i \
+      # Define default md \
+      \$config['default_md']    = "'$defaultmd'";' /opt/phpki/phpki-store/config/config.php
+      echo "Done... continuing to install"
+    fi 
 else
-    echo "No directory detected...continuing installaton"
+    echo "No directory detected... continuing to install"
 fi
 
 
 
 if ! /usr/bin/id phpki &>/dev/null; then
-echo "Creating phpki user"
-	/usr/sbin/useradd -c 'Phpki User' -s /sbin/nologin -r -d /opt/phpki/phpki-store phpki &>/dev/null || \
+  echo "Creating phpki user"
+  /usr/sbin/useradd -c 'Phpki User' -s /sbin/nologin -r -d /opt/phpki/phpki-store phpki &>/dev/null || \
 		%logmsg "Unexpected error adding user \"phpki\". Abort installation."
 fi
 
@@ -298,9 +330,12 @@ fi
 %post
 # First install, point index.php to setup.php
 if [ $1 == 1 ]; then
+  #do not do if there is already a CA (restore from backup))
+  if [ ! -f /opt/phpki/phpki-store/config/config.php ] ; then
 	%{__ln_s} /opt/phpki/html/setup.php-presetup /opt/phpki/html/index.php
 	%{__ln_s} /opt/phpki/html/setup.php-presetup /opt/phpki/html/setup.php
-	echo "<?php
+  fi
+  echo "<?php
 header(\"Location: ./../index.php\");
 ?>
 " > /opt/phpki/html/ca/index.php