--- rpms/phpki-ng/contribs10/phpki-ng.spec 2021/03/08 13:37:51 1.3 +++ rpms/phpki-ng/contribs10/phpki-ng.spec 2022/12/14 21:52:41 1.16 @@ -4,7 +4,7 @@ %define name phpki-ng %define version 0.84 -%define release 3 +%define release 15 Summary: Phpki is a simple certificate management suite Name: %{name} Version: %{version} @@ -16,6 +16,14 @@ Group: SMEserver/addon Source: %{name}-%{version}.tar.gz Patch1: phpki-ng-0.84-fix-for-php74-code-tidy.patch Patch2: phpki-ng-0.84-fix-pregmatch-revoke-certs.patch +Patch3: phpki-ng-0.84-fix-crl.patch +Patch4: phpki-ng-0.84-fix-missing-slash-certtype-detection.patch +Patch5: phpki-ng-0.84-fix-html-directory-check.patch +Patch6: phpki-ng-0.84-fix-download-cert.patch +Patch7: phpki-ng-0.84-fix-html-syntax-in-help.patch +Patch8: phpki-ng-0.84-fix-final-redirect.patch +Patch9: phpki-ng-bz12272-bz12273-crl-whitespacepass.patch +Patch10: phpki-ng-bz12274-regex-secu.patch BuildArch: noarch BuildRoot: /var/tmp/%{name}-%{version} @@ -38,13 +46,61 @@ With it, you may create and centrally ma e-mail clients, SSL servers, and VPN applications. %changelog +* Wed Dec 14 2022 Jean-Philippe Pialasse 0.84-15.sme +- fix regex and potential code injection [SME: 12274] + +* Wed Dec 14 2022 Jean-Philippe Pialasse 0.84-14.sme +- add easy and safe access to crl download [SME: 12272] +- fix revoke certificate failing on whitespace pass [SME: 12273] +- fix missing default_md in config.php from previous versions [SME: 12267] +- updated scriptlet to ease backup and restore + +* Fri Nov 18 2022 Jean-Philippe Pialasse 0.84-13.sme +- remove extra space in URL in search.php [SME: 12232] + +* Thu Sep 30 2021 John Crisp 0.84-12.sme +- Attempt to fix the final reload after CA creation [SME: 11192] + +* Thu Aug 05 2021 John Crisp 0.84-11.sme +- Fix html syntax error in help - Thanks Mauro De Carolis [SME: 11688] + +* Tue Apr 06 2021 John Crisp 0.84-10.sme +- And tidy up the copying wording. [SME: 11192] +- Credit to Terry Fage for persisting with testing + +* Mon Apr 05 2021 John Crisp 0.84-9.sme +- Really fix the copy this time [SME: 11192] + +* Sat Apr 03 2021 John Crisp 0.84-8.sme +- copy phpki-store as a backup instead of move [SME: 11192] + +* Thu Apr 01 2021 John Crisp 0.84-7.sme +- Fix broken Download Certificate in Cert generation [SME: 11513] + +* Thu Mar 18 2021 John Crisp 0.84-6.sme +- Update html header info [SME: 11192] +- Remove obsolete align +- Remove accidentally duplicated html +- Fix typo +- Fix directory check +- move function flush_exec to functions file + +* Tue Mar 09 2021 John Crisp 0.84-5.sme +- Fix missing / [SME:11435] +- Update cert type detection for renew [SME: 11436] +- Code formatting + +* Mon Mar 08 2021 John Crisp 0.84-4.sme +- Fix crl creation [SME: 11141] +- Extra notes in setup page + * Mon Mar 08 2021 John Crisp 0.84-3.sme - Fix Typo in certificate password [SME: 11435] - Fix typos and preg_match issues [SME: 11436] -- Add Certificate ctreation notification [SME: 11437] -- Bit of file fomatting +- Add Certificate creation notification [SME: 11437] +- Bit of file formatting -* Wed Mar 07 2021 John Crisp 0.84-2.sme +* Wed Mar 03 2021 John Crisp 0.84-2.sme - Change version to 0.84 - Fix undefined constant errors [SME: 11397] - fix tempdir [SME: 11398] @@ -158,6 +214,14 @@ e-mail clients, SSL servers, and VPN app %setup -c -n %{name} %patch1 -p1 %patch2 -p1 +%patch3 -p1 +%patch4 -p1 +%patch5 -p1 +%patch6 -p1 +%patch7 -p1 +%patch8 -p1 +%patch9 -p1 +%patch10 -p1 %build %{__mkdir_p} root/opt/phpki/html @@ -215,30 +279,48 @@ echo "********************************** echo "* This contrib now has higher levels of encryption" echo "* " echo "* We cannot upgrade your existing certificates" +echo "* existing certificates from SME9 or below have either " +echo "* md5WithRSAEncryption sha1WithRSAEncryption" +echo "* as Signature Algorithm (weak)." +echo "* only way to update to sha256 or sha512 is to " +echo "* start from scratch." echo "* " -echo "* If we detect an existing certificate store" -echo "* we are going to move it" +echo "* If you have existing certificates you want to use" +echo "* then start with a new CA, backup up, and then restore" +echo "* your phpki-store directory in /opt/phpki" echo "* " -echo "* You can then start with a new CA and certificates" echo "******************************************************" echo "" if [ -d /opt/phpki/phpki-store ] ; then echo "Backing up your /opt/phpki/phpki-store" - RANDOM=$$ - PHPKIDIR=$(( 1 + $RANDOM%99999 )) - echo "Number is $PHPKIDIR" - echo "moving from /opt/phpki/phpki-store to /opt/phpki/phpki-store.$PHPKIDIR" - mv /opt/phpki/phpki-store "/opt/phpki/phpki-store.$PHPKIDIR" - echo "Directory moved...continuing installaton" + today=$(date "+%Y%m%d%H%M") + echo "Copying from /opt/phpki/phpki-store to /opt/phpki/phpki-store.$today" + /bin/cp -pr /opt/phpki/phpki-store "/opt/phpki/phpki-store.$today" + echo "Directory copied... continuing to install" + # fix missing md_default + if ( grep default_md /opt/phpki/phpki-store/config/config.php -q ); then + echo "md_default OK" + else + echo "default_md missing in /opt/phpki/phpki-store/config/config.php" + echo "getting value from /opt/phpki/phpki-store/config/openssl.cnf" + # it could ba acceptable to hash sha256 a certificate from a root with sha1. + defaultmd=$(awk '/^default_md/{print $NF}' /opt/phpki/phpki-store/config/openssl.cnf || echo "sha512") + echo "inserting $defaultmd default_md at end of /opt/phpki/phpki-store/config/config.php" + sed -i '/\?>/i \ + # Define default md \ + \$config['default_md'] = "'$defaultmd'";' /opt/phpki/phpki-store/config/config.php + echo "Done... continuing to install" + fi else - echo "No directory detected...continuing installaton" + echo "No directory detected... continuing to install" fi -echo "Creating phpki user" + if ! /usr/bin/id phpki &>/dev/null; then - /usr/sbin/useradd -c 'Phpki User' -s /sbin/nologin -r -d /opt/phpki/phpki-store phpki &>/dev/null || \ + echo "Creating phpki user" + /usr/sbin/useradd -c 'Phpki User' -s /sbin/nologin -r -d /opt/phpki/phpki-store phpki &>/dev/null || \ %logmsg "Unexpected error adding user \"phpki\". Abort installation." fi @@ -248,9 +330,12 @@ fi %post # First install, point index.php to setup.php if [ $1 == 1 ]; then + #do not do if there is already a CA (restore from backup)) + if [ ! -f /opt/phpki/phpki-store/config/config.php ] ; then %{__ln_s} /opt/phpki/html/setup.php-presetup /opt/phpki/html/index.php %{__ln_s} /opt/phpki/html/setup.php-presetup /opt/phpki/html/setup.php - echo " " > /opt/phpki/html/ca/index.php