--- rpms/phpki-ng/contribs10/phpki-ng.spec 2021/04/03 14:32:38 1.9 +++ rpms/phpki-ng/contribs10/phpki-ng.spec 2022/12/17 07:19:17 1.17 @@ -4,7 +4,7 @@ %define name phpki-ng %define version 0.84 -%define release 8 +%define release 16 Summary: Phpki is a simple certificate management suite Name: %{name} Version: %{version} @@ -20,6 +20,10 @@ Patch3: phpki-ng-0.84-fix-crl.pa Patch4: phpki-ng-0.84-fix-missing-slash-certtype-detection.patch Patch5: phpki-ng-0.84-fix-html-directory-check.patch Patch6: phpki-ng-0.84-fix-download-cert.patch +Patch7: phpki-ng-0.84-fix-html-syntax-in-help.patch +Patch8: phpki-ng-0.84-fix-final-redirect.patch +Patch9: phpki-ng-bz12272-bz12273-crl-whitespacepass.patch +Patch10: phpki-ng-bz12274-regex-secu.patch BuildArch: noarch BuildRoot: /var/tmp/%{name}-%{version} @@ -42,14 +46,42 @@ With it, you may create and centrally ma e-mail clients, SSL servers, and VPN applications. %changelog -* Sat Apr 03 2021 John Crisp 0.84-7.sme -- copy phpki-store as a backup instead of move +* Sat Dec 17 2022 Jean-Philippe Pialasse 0.84-16.sme +- add dl_crl_pem.php [SME: 12272] + +* Wed Dec 14 2022 Jean-Philippe Pialasse 0.84-15.sme +- fix regex and potential code injection [SME: 12274] + +* Wed Dec 14 2022 Jean-Philippe Pialasse 0.84-14.sme +- add easy and safe access to crl download [SME: 12272] +- fix revoke certificate failing on whitespace pass [SME: 12273] +- fix missing default_md in config.php from previous versions [SME: 12267] +- updated scriptlet to ease backup and restore + +* Fri Nov 18 2022 Jean-Philippe Pialasse 0.84-13.sme +- remove extra space in URL in search.php [SME: 12232] + +* Thu Sep 30 2021 John Crisp 0.84-12.sme +- Attempt to fix the final reload after CA creation [SME: 11192] + +* Thu Aug 05 2021 John Crisp 0.84-11.sme +- Fix html syntax error in help - Thanks Mauro De Carolis [SME: 11688] + +* Tue Apr 06 2021 John Crisp 0.84-10.sme +- And tidy up the copying wording. [SME: 11192] +- Credit to Terry Fage for persisting with testing + +* Mon Apr 05 2021 John Crisp 0.84-9.sme +- Really fix the copy this time [SME: 11192] + +* Sat Apr 03 2021 John Crisp 0.84-8.sme +- copy phpki-store as a backup instead of move [SME: 11192] * Thu Apr 01 2021 John Crisp 0.84-7.sme - Fix broken Download Certificate in Cert generation [SME: 11513] * Thu Mar 18 2021 John Crisp 0.84-6.sme -- Update html header info +- Update html header info [SME: 11192] - Remove obsolete align - Remove accidentally duplicated html - Fix typo @@ -189,6 +221,10 @@ e-mail clients, SSL servers, and VPN app %patch4 -p1 %patch5 -p1 %patch6 -p1 +%patch7 -p1 +%patch8 -p1 +%patch9 -p1 +%patch10 -p1 %build %{__mkdir_p} root/opt/phpki/html @@ -246,6 +282,11 @@ echo "********************************** echo "* This contrib now has higher levels of encryption" echo "* " echo "* We cannot upgrade your existing certificates" +echo "* existing certificates from SME9 or below have either " +echo "* md5WithRSAEncryption sha1WithRSAEncryption" +echo "* as Signature Algorithm (weak)." +echo "* only way to update to sha256 or sha512 is to " +echo "* start from scratch." echo "* " echo "* If you have existing certificates you want to use" echo "* then start with a new CA, backup up, and then restore" @@ -256,20 +297,33 @@ echo "" if [ -d /opt/phpki/phpki-store ] ; then echo "Backing up your /opt/phpki/phpki-store" - RANDOM=$$ - PHPKIDIR=$(( 1 + $RANDOM%99999 )) - echo "Number is $PHPKIDIR" - echo "moving from /opt/phpki/phpki-store to /opt/phpki/phpki-store.$PHPKIDIR" - mv /opt/phpki/phpki-store "/opt/phpki/phpki-store.$PHPKIDIR" - echo "Directory moved...continuing installaton" + today=$(date "+%Y%m%d%H%M") + echo "Copying from /opt/phpki/phpki-store to /opt/phpki/phpki-store.$today" + /bin/cp -pr /opt/phpki/phpki-store "/opt/phpki/phpki-store.$today" + echo "Directory copied... continuing to install" + # fix missing md_default + if ( grep default_md /opt/phpki/phpki-store/config/config.php -q ); then + echo "md_default OK" + else + echo "default_md missing in /opt/phpki/phpki-store/config/config.php" + echo "getting value from /opt/phpki/phpki-store/config/openssl.cnf" + # it could ba acceptable to hash sha256 a certificate from a root with sha1. + defaultmd=$(awk '/^default_md/{print $NF}' /opt/phpki/phpki-store/config/openssl.cnf || echo "sha512") + echo "inserting $defaultmd default_md at end of /opt/phpki/phpki-store/config/config.php" + sed -i '/\?>/i \ + # Define default md \ + \$config['default_md'] = "'$defaultmd'";' /opt/phpki/phpki-store/config/config.php + echo "Done... continuing to install" + fi else - echo "No directory detected...continuing installaton" + echo "No directory detected... continuing to install" fi -echo "Creating phpki user" + if ! /usr/bin/id phpki &>/dev/null; then - /usr/sbin/useradd -c 'Phpki User' -s /sbin/nologin -r -d /opt/phpki/phpki-store phpki &>/dev/null || \ + echo "Creating phpki user" + /usr/sbin/useradd -c 'Phpki User' -s /sbin/nologin -r -d /opt/phpki/phpki-store phpki &>/dev/null || \ %logmsg "Unexpected error adding user \"phpki\". Abort installation." fi @@ -279,9 +333,12 @@ fi %post # First install, point index.php to setup.php if [ $1 == 1 ]; then + #do not do if there is already a CA (restore from backup)) + if [ ! -f /opt/phpki/phpki-store/config/config.php ] ; then %{__ln_s} /opt/phpki/html/setup.php-presetup /opt/phpki/html/index.php %{__ln_s} /opt/phpki/html/setup.php-presetup /opt/phpki/html/setup.php - echo " " > /opt/phpki/html/ca/index.php