[TWiki-Dev] [SVN] SvenDowideit r15280 - in twiki/branches/MAIN/tools/pkg/debian: . po

[<de...@de...>]

Author: SvenDowideit
Date: 2007-10-14 06:44:55 -0500 (Sun, 14 Oct 2007)
New Revision: 15280

Added:
   twiki/branches/MAIN/tools/pkg/debian/po/nl.po
Modified:
   twiki/branches/MAIN/tools/pkg/debian/LocalSite.cfg
   twiki/branches/MAIN/tools/pkg/debian/apache.conf
   twiki/branches/MAIN/tools/pkg/debian/changelog
   twiki/branches/MAIN/tools/pkg/debian/dirs
   twiki/branches/MAIN/tools/pkg/debian/postinst
Log:
Item4814: fix CVE in debian package

Modified: twiki/branches/MAIN/tools/pkg/debian/LocalSite.cfg
===================================================================
--- twiki/branches/MAIN/tools/pkg/debian/LocalSite.cfg	2007-10-14 06:20:43 UTC (rev 15279)
+++ twiki/branches/MAIN/tools/pkg/debian/LocalSite.cfg	2007-10-14 11:44:55 UTC (rev 15280)
@@ -8,9 +8,10 @@
 $TWiki::cfg{PubUrlPath} = '/twiki/pub';
 $TWiki::cfg{PubDir} = '/var/www/twiki/pub';
 $TWiki::cfg{TemplateDir} = '/var/lib/twiki/templates';
-$TWiki::cfg{Sessions}{Dir} = '/tmp/twiki';
-$TWiki::cfg{PassthroughDir} = '/tmp/twiki';
 $TWiki::cfg{Site}{CharSet} = 'iso-8859-15';
 $TWiki::cfg{LoginManager} = 'TWiki::Client::ApacheLogin';
 $TWiki::cfg{Plugins}{WysiwygPlugin}{Enabled} = 1;
+$TWiki::cfg{RCS}{WorkAreaDir} = '/usr/lib/twiki/working/work_areas';
+$TWiki::cfg{Sessions}{Dir} = '/usr/lib/twiki/working/tmp';
+$TWiki::cfg{PassthroughDir} = '/usr/lib/twiki/working/tmp';
 1;

Modified: twiki/branches/MAIN/tools/pkg/debian/apache.conf
===================================================================
--- twiki/branches/MAIN/tools/pkg/debian/apache.conf	2007-10-14 06:20:43 UTC (rev 15279)
+++ twiki/branches/MAIN/tools/pkg/debian/apache.conf	2007-10-14 11:44:55 UTC (rev 15280)
@@ -1,3 +1,6 @@
+# Autogenerated httpd.conf file for TWiki.
+# Generated at http://twiki.org/cgi-bin/view/TWiki/ApacheConfigGenerator
+
 # We set an environment variable called blockAccess.
 #
 # Setting a BrowserMatchNoCase to ^$ is important. It prevents TWiki from
@@ -81,30 +84,24 @@
 BrowserMatchNoCase ^ZIBB blockAccess
 BrowserMatchNoCase ^$ blockAccess
 
+RedirectMatch /twiki/?$ http://localhost/cgi-bin/twiki/view$1
+RedirectMatch /twiki(/([A-Z].*)?)?$ http://localhost/cgi-bin/twiki/view$1
 
+# The ScriptAlias defines the bin directory as a directory where CGI
+# scripts are allowed.
+# The first parameter will be part of the URL to your installation e.g.
+# http://my.co.uk/twiki/bin/view/...
+# The second parameter must point to the physical path on your disc.
+#ScriptAlias /twiki/bin "/var/lib/twiki/bin"
 
-# Added for twiki
-Alias /twiki/pub /var/www/twiki/pub
+# The Alias defines a url that points to the root of the twiki installation.
+# It is used to access files in the pub directory (attachments etc)
+# It must come _after_ the ScriptAlias.
+Alias /twiki/pub "/var/www/twiki/pub"
 
-RedirectMatch /twiki(/([A-Z].*)?)?$ http://your.domain.com/cgi-bin/twiki/view$1
-
-#TODO: detect if apache1 or apache 2...
-#<IfModule mod_perl.c>
-#    <IfDefine APACHE2>
-#        #mod_perl for apache2
-#        PerlRequire /var/lib/twiki/tools/mod_perl_startup.pl
-#        # Turn on taint checking
-#        PerlSwitches -T
-#    </IfDefine>
-    #<IfDefine !APACHE2>
-    #    #assume this is apache1.3.x
-    #    PerlRequire /var/lib/twiki/tools/mod_perl_startup.pl
-    #    # Turn on taint checking (only add line below if it is not already in the httpd.conf)   
-    #    PerlTaintCheck On
-    #</IfDefine>
-#</IfModule>
-
-# make sure this is even needed, and ref the doc section needing it 
+# This specifies the options on the TWiki scripts directory. The ExecCGI
+# and SetHandler tell apache that it contains scripts. "Allow from all"
+# lets any IP address access this URL.
 <Directory /usr/lib/cgi-bin/twiki/> 
 	BrowserMatchNoCase ^$ anonymous_spider
 	
@@ -118,14 +115,15 @@
 	AuthName 'Enter your WikiName: (First name and last name, no space, no dots, capitalized, e.g. JohnSmith). Cancel to register if you do not have one.'
 	AuthType Basic
 
-	ErrorDocument 401 /cgi-bin/twiki/view/TWiki/TWikiRegistration
+    # File to return on access control error (e.g. wrong password)
+    ErrorDocument 401 /cgi-bin/twiki/view/TWiki/TWikiRegistration
 
 	Options +ExecCGI +FollowSymLinks
 	SetHandler cgi-script
 	AllowOverride all
 	Allow from all
 	
-	<FilesMatch "^configure">
+	<FilesMatch "^(configure)$">
 		Order Deny,Allow
 		Deny from all
 		Allow from 127.0.0.1
@@ -136,29 +134,6 @@
 	<FilesMatch "(attach|edit|manage|rename|save|upload|mail|logon|.*auth).*">
 		require valid-user
 	</FilesMatch>
-	
-#	<IfModule mod_perl.c>
-#        <IfDefine APACHE2>
-#            #mod_perl - apache 2
-#            # This matches all lower-case file names, except
-#            # those starting with "configure"
-#            <FilesMatch "^(?!configure)[a-z.]+$">
-#                    SetHandler perl-script
-#                    PerlResponseHandler ModPerl::Registry
-#                    PerlSendHeader On
-#                    PerlOptions +ParseHeaders
-#            </FilesMatch>
-#        </IfDefine>
-        #<IfDefine !APACHE2>
-        #    #assume this is apache1.3.x
-        #    # This matches all lower-case file names, except
-        #    # those starting with "configure"
-        #    <FilesMatch "^(?!configure)[a-z.]+$">
-        #        SetHandler perl-script
-        #        PerlHandler Apache::Registry
-        #    </FilesMatch>            
-        #</IfDefine>
-#	</IfModule>
 </Directory>
 
 # This sets the options on the pub directory, which contains attachments and
@@ -175,17 +150,30 @@
     Allow from all
     Deny from env=blockAccess
 
-    # Disable execusion of PHP scripts
-    <IfModule mod_php5.c>
-    	php_admin_flag engine off
-    </IfModule>
-    <IfModule mod_php4.c>
-    	php_admin_flag engine off
-    </IfModule>
-
     # This line will redefine the mime type for the most common types of scripts
-    # It will also deliver HTML files as if they are text files
-    AddType text/plain .html .htm .shtml .php .php3 .phtml .phtm .pl .py .cgi
+    AddType text/plain .shtml .php .php3 .phtml .phtm .pl .py .cgi
+#
+#add an Expires header that is sufficiently in the future that the browser does not even ask if its uptodate
+# reducing the load on the server significantly
+#IF you can, you should enable this - it _will_ improve your twiki experience, even if you set it to under one day.
+# you may need to enable expires_module in your main apache config
+#LoadModule expires_module libexec/httpd/mod_expires.so
+#AddModule mod_expires.c
+#<ifmodule mod_expires.c>
+#  <filesmatch "\.(jpg|gif|png|css|js)$">
+#       ExpiresActive on
+#       ExpiresDefault "access plus 11 days"
+#   </filesmatch>
+#</ifmodule>
+#
+
 </Directory>
 
-# End twiki Configuration Block
+# Security note: All other directories should be set so
+# that they are *not* visible as URLs, so we set them as =deny from all=.
+# protect it in case its still there.
+<Directory "/var/www/twiki/pub/_work_areas">
+    deny from all
+</Directory>
+
+

Modified: twiki/branches/MAIN/tools/pkg/debian/changelog
===================================================================
--- twiki/branches/MAIN/tools/pkg/debian/changelog	2007-10-14 06:20:43 UTC (rev 15279)
+++ twiki/branches/MAIN/tools/pkg/debian/changelog	2007-10-14 11:44:55 UTC (rev 15280)
@@ -1,8 +1,10 @@
-twiki (1:4.1.2-2) unstable; urgency=low
+twiki (1:4.1.2-2) unstable; urgency=high
 
-  * add commented out mod_perl on apache 2 support using IFModule
+  * secure /var/www/twiki/pub/_work_areas (Closes: #444982)
+    CVE-2007-5193
+  * added Dutch translation (Closes: #422245)
 
- -- Sven Dowideit <SvenDowideit@DistributedINFORMATION.com>  Sun, 22 Apr 2007 09:53:40 +0100
+ -- Sven Dowideit <SvenDowideit@DistributedINFORMATION.com>  Sun, 14 Oct 2007 09:53:40 +0100
 
 twiki (1:4.1.2-1) unstable; urgency=low
 

Modified: twiki/branches/MAIN/tools/pkg/debian/dirs
===================================================================
--- twiki/branches/MAIN/tools/pkg/debian/dirs	2007-10-14 06:20:43 UTC (rev 15279)
+++ twiki/branches/MAIN/tools/pkg/debian/dirs	2007-10-14 11:44:55 UTC (rev 15280)
@@ -7,4 +7,6 @@
 etc/twiki
 usr/share/doc/twiki
 usr/share/twiki
-tmp/twiki
+usr/lib/twiki/working
+usr/lib/twiki/working/tmp
+usr/lib/twiki/working/work_areas

Added: twiki/branches/MAIN/tools/pkg/debian/po/nl.po
===================================================================
--- twiki/branches/MAIN/tools/pkg/debian/po/nl.po	                        (rev 0)
+++ twiki/branches/MAIN/tools/pkg/debian/po/nl.po	2007-10-14 11:44:55 UTC (rev 15280)
@@ -0,0 +1,66 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: twiki\n"
+"Report-Msgid-Bugs-To: sv...@oz...\n"
+"POT-Creation-Date: 2007-02-17 09:09+0100\n"
+"PO-Revision-Date: 2007-04-25 18:00+0100\n"
+"Last-Translator: Bart Cornelis <co...@sk...>\n"
+"Language-Team: debian-l10n-dutch <deb...@li...>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=utf-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Poedit-Language: Dutch\n"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "Top-level URL of the server TWiki runs under:"
+msgstr "Hoogste-niveau URL van de server waar TWiki draait:"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "For a normal install, this should be a URL for your web server's full name, which is used to construct URLs on some pages.  The install will serve up the data by adding \"twiki\" to the end of this setting; it is also needed for certain redirections."
+msgstr "Voor een normale installatie dient deze URL de volledige naam van uw webserver te zijn. Deze URL wordt gebruikt bij het opbouwen van de URL's op sommige pagina's. De installatie biedt de data aan door 'twiki' toe te voegen aan het eind van deze instelling. Dit is tevens nodig voor sommige omleidingen."
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Email address of the webmaster for this TWiki:"
+msgstr "E-mailadres van de webmeester voor dit TWiki:"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "This email address gets mail for new user registration, and is listed on the \"oops\" page when things go wrong."
+msgstr "Dit e-mailadres krijgt de berichten omtrent registratie van nieuwe gebruikers, en wordt weergegeven op de 'oops'-pagina wanneer er iets mis gaat."
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Install default wiki Topic Set on initial install?"
+msgstr "Wilt u de standaard set wiki onderwerpen installeren tijdens de de initiële installatie?"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "TWiki includes a complete \"starter kit\" which includes user registration pages, documentation, and tutorials.  Only decline if you're re-installing TWiki after deleting the package and want to keep the old data, or if you've got a TWiki data set from your own manual install.  If data/Main/WebHome.txt is present, the starter kit will not be unpacked.  The starter kit files can be found in /usr/share/twiki/twiki-data.tar.gz (and twiki-pub.tar.gz), if you want to install it manually or compare your topics with the new version."
+msgstr "TWiki bevat een complete 'starter-kit' die onder andere registratiepagina's, documentatie en handleidingen omvat. Sla dit enkel af wanneer u TWiki herinstalleert na het pakket verwijderd te hebben en u de oude data wilt bewaren, of wanneer u een TWiki dataset heeft van uw eigen handmatige installatie. Als data/Main/WebHome.txt aanwezig is wordt de starter-kit niet uitgepakt. De starter-kit bestanden vindt u terug in /usr/share/twiki/twiki-data.tar.gz en twiki-pub.tar.gz (voor als u dit handmatig wilt installeren, of als u uw onderwerpen wilt vergelijken met de nieuwe versie)."
+
+#. Type: note
+#. Description
+#: ../templates:4001
+msgid "Admin User Registration configuration required"
+msgstr "Configuratie van de Beheerder-registratie is verplicht"
+
+#. Type: note
+#. Description
+#: ../templates:4001
+msgid "After you have created yourself a user, edit the Main.TWikiAdminGroup to restrict Admin privileges to that user."
+msgstr "Eens u een gebruiker heeft aangemaakt dient u de Main.TWikiAdminGroup aan te passen om Beheerdersrechten te beperken tot die gebruiker."
+

Modified: twiki/branches/MAIN/tools/pkg/debian/postinst
===================================================================
--- twiki/branches/MAIN/tools/pkg/debian/postinst	2007-10-14 06:20:43 UTC (rev 15279)
+++ twiki/branches/MAIN/tools/pkg/debian/postinst	2007-10-14 11:44:55 UTC (rev 15280)
@@ -139,13 +139,19 @@
 	fi
 
 	#create securer-twiki session dir
-	if [ ! -e /tmp/twiki ]; then
-		mkdir /tmp/twiki 
+	if [ ! -e /var/lib/twiki/working ]; then
+		mkdir /var/lib/twiki/working 
 	fi
+	if [ ! -e /var/lib/twiki/working/tmp ]; then
+		mkdir /var/lib/twiki/working/tmp 
+	fi
+	if [ ! -e /var/lib/twiki/working/work_areas ]; then
+		mkdir /var/lib/twiki/working/work_areas
+	fi
 	#mmmm, mailnotify etc may be running _not_ as www-data
 	#and for some reason create a session
-	chmod 777 /tmp/twiki 
-	chown $TWIKI_OWNER.www-data /tmp/twiki 
+	chmod 777 /var/lib/twiki/working/tmp 
+	chown $TWIKI_OWNER.www-data /var/lib/twiki/working/tmp 
 
 	#add softlinks to make adding plugins easier ()
 	if [ ! -e /var/lib/twiki/lib ]; then