Testing (#47)

.github/ISSUE_TEMPLATE.md

@@ -1,6 +1,6 @@
 ---
 name: Bug report
-about: Create a report to help us debug, it would be nice to fill the template as much as you can to help us, help you and help us all.
+about: When creating a bug report, please use the following template to provide all the relevant information and help debugging efficiently.
 
 ---
 
@@ -8,15 +8,17 @@ about: Create a report to help us debug, it would be nice to fill the template a
 1. *Read this whole template first.*
 2. *Determine if you are on the right place:*
    - *If you were performing an action on the app from the webadmin or the CLI (install, update, backup, restore, change_url...), you are on the right place!*
-   - *Otherwise, the issue may be due to Matomo itself. Refer to its documentation or repository for help.*
+   - *Otherwise, the issue may be due to the app itself. Refer to its documentation or repository for help.*
-   - *If you have a doubt, post here, we will figure it out together.*
+   - *When in doubt, post here and we will figure it out together.*
 3. *Delete the italic comments as you write over them below, and remove this guide.*
 --- 
 
-**Describe the bug**
+### Describe the bug
+
 *A clear and concise description of what the bug is.*
 
-**Versions**
+### Context
+
 - Hardware: *VPS bought online / Old laptop or computer / Raspberry Pi at home / Internet Cube with VPN / Other ARM board / ...*
 - YunoHost version: x.x.x
 - I have access to my server: *Through SSH | through the webadmin | direct access via keyboard / screen | ...*
@@ -25,11 +27,11 @@ about: Create a report to help us debug, it would be nice to fill the template a
 - Using, or trying to install package version/branch:
 - If upgrading, current package version: *can be found in the admin, or with `yunohost app info $app_id`*
 
-**To Reproduce**
+### Steps to reproduce
-*Steps to reproduce the behavior.*
+
 - *If you performed a command from the CLI, the command itself is enough. For example:*
     ```sh
-    sudo yunohost app install matomo
+    sudo yunohost app install the_app
     ```
 - *If you used the webadmin, please perform the equivalent command from the CLI first.*
 - *If the error occurs in your browser, explain what you did:*
@@ -38,9 +40,16 @@ about: Create a report to help us debug, it would be nice to fill the template a
    3. *Scroll down to '...'*
    4. *See error*
 
-**Expected behavior**
+### Expected behavior
+
 *A clear and concise description of what you expected to happen. You can remove this section if the command above is enough to understand your intent.*
 
-**Logs**
+### Logs
-*After a failed command, YunoHost makes the log available to you, but also to others, thanks to `yunohost log display [log name] --share`. The actual command, with the correct log name, is displayed at the end of the failed attempt in the CLI. Execute it and copy here the share link it outputs.*
+
+*When an operation fails, YunoHost provides a simple way to share the logs.*
+- *In the webadmin, the error message contains a link to the relevant log page. On that page, you will be able to 'Share with Yunopaste'. If you missed it, the logs of previous operations are also available under Tools > Logs.*
+- *In command line, the command to share the logs is displayed at the end of the operation and looks like `yunohost log display [log name] --share`. If you missed it, you can find the log ID of a previous operation using `yunohost log list`.*
+
+*After sharing the log, please copypaste directly the link provided by YunoHost (to help readability, no need to copypaste the entire content of the log here, just the link is enough...)*
+
 *If applicable and useful, add screenshots to help explain your problem.*

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,16 @@
+## Problem
+
+- *Description of why you made this PR*
+
+## Solution
+
+- *And how do you fix that problem*
+
+## PR Status
+
+- [ ] Code finished and ready to be reviewed/tested
+- [ ] The fix/enhancement were manually tested (if applicable)
+
+## Automatic tests
+
+Automatic tests can be triggered on https://ci-apps-dev.yunohost.org/ *after creating the PR*, by commenting "!testme", "!gogogadgetoci" or "By the power of systemd, I invoke The Great App CI to test this Pull Request!". (N.B. : for this to work you need to be a member of the Yunohost-Apps organization)

README.md

@@ -11,7 +11,7 @@ If you don't have YunoHost, please consult [the guide](https://yunohost.org/inst
 ## Overview
 Matomo is the leading Free/Libre open analytics platform. It is a full-featured PHP MySQL software program that you download and install on your own webserver. At the end of the five-minute installation process, you will be given a JavaScript code. Simply copy and paste this tag on websites you wish to track and access your analytics reports in real-time.
 
-**Shipped version:** 4.2.1
+**Shipped version:** 4.3.1
 
 ## Screenshots
 

README_fr.md

@@ -11,7 +11,7 @@ Si vous n'avez pas YunoHost, consultez [le guide](https://yunohost.org/install)
 ## Vue d'ensemble
 Matomo est une plateforme d'analyse open source de mesure de statistiques Web. Il s'agit d'un logiciel PHP MySQL complet que vous téléchargez et installez sur votre propre serveur Web. À la fin du processus d'installation de cinq minutes, vous recevrez un code JavaScript. Copiez et collez simplement cette balise sur les sites Web que vous souhaitez suivre et accédez à vos rapports d'analyse en temps réel.
 
-**Version incluse :** 4.2.1
+**Version incluse :** 4.3.1
 
 ## Captures d'écran
 

check_process

@@ -1,13 +1,8 @@
-# See here for more information
-# https://github.com/YunoHost/package_check#syntax-check_process-file
-
-# Move this file from check_process.default to check_process when you have filled it.
-
 ;; Test complet
 	; Manifest
-		domain="domain.tld"	(DOMAIN)
+		domain="domain.tld"
-		path="/path"	(PATH)
+		path="/path"
-		is_public=1	(PUBLIC|public=1|private=0)
+		is_public=1
 	; Checks
 		pkg_linter=1
 		setup_sub_dir=1
@@ -19,7 +14,6 @@
 		upgrade=1	from_commit=1d3e9f3dbf72a6a124c879fa549ab8107367e36a
 		backup_restore=1
 		multi_instance=1
-		port_already_use=0
 		change_url=1
 ;;; Options
 Email=anmol@datamol.org

conf/app.src

@@ -1,5 +1,5 @@
-SOURCE_URL=https://github.com/matomo-org/matomo/archive/4.2.1.tar.gz
+SOURCE_URL=https://github.com/matomo-org/matomo/archive/refs/tags/4.3.1.tar.gz
-SOURCE_SUM=e84b86186ef0924b4d4479ec3162bbc9cb30e430b3a55a7f6d8a08e84704b33f
+SOURCE_SUM=1b81dff17dd35e1b3a1fe6a5fe28a2916c5fb5537bf3fafc13020f52becf888a
 SOURCE_SUM_PRG=sha256sum
 SOURCE_FORMAT=tar.gz
 SOURCE_IN_SUBDIR=true

conf/config.ini.php

@@ -1,9 +0,0 @@
-; <?php exit; ?> DO NOT REMOVE THIS LINE
-; file automatically generated or modified by Matomo; you can manually override the default values in global.ini.php by redefining them in this file.
-[database]
-host = "127.0.0.1"
-username = "__DB_NAME__"
-password = "__DB_PWD__"
-dbname = "__DB_NAME__"
-tables_prefix = "matomo_"
-charset = "utf8mb4"

conf/nginx.conf

@@ -1,20 +1,22 @@
 #sub_path_only rewrite ^__PATH__$ __PATH__/ permanent;
-location __PATH__/ {
+location ^~ __PATH__/ {
 
     # Path to source
-  alias __FINALPATH__/ ;
+    alias  __FINALPATH__/;
 
   # Force usage of https
   if ($scheme = http) {
     rewrite ^ https://$server_name$request_uri? permanent;
   }
 
+  more_set_headers "Referrer-Policy: origin always";
+  more_set_headers "X-Content-Type-Options: nosniff";
+  more_set_headers "X-XSS-Protection: 1; mode=block";
+  
   index index.php;
 
-  # Common parameter to increase upload size limit in conjunction with dedicated PHP-FPM file
+  try_files $uri $uri/ =404;
-  client_max_body_size 100M;
 
-  try_files $uri $uri/ index.php;
   location ~ [^/]\.php(/|$) {
     fastcgi_split_path_info ^(.+?\.php)(/.*)$;
     fastcgi_pass unix:/var/run/php/php__PHPVERSION__-fpm-__NAME__.sock;
@@ -26,6 +28,62 @@ location __PATH__/ {
     fastcgi_param SCRIPT_FILENAME $request_filename;
     }
 
-  # Include SSOWAT user panel.
+    ## deny access to all other .php files
+    location ~* ^.+\.php$ {
+        deny all;
+        return 403;
+    }
+
+    ## disable all access to the following directories
+    location ^~ __PATH__/config/ {
+        deny all;
+        return 403;
+    }
+
+    location ^~ __PATH__/tmp/ {
+        deny all;
+        return 403;
+    }
+
+    location ^~ __PATH__/core/ {
+        deny all;
+        return 403;
+    }
+
+    location ^~ __PATH__/lang/ {
+        deny all;
+        return 403;
+    }
+
+    location ~ __PATH__/\.ht {
+        deny  all;
+        return 403;
+    }
+
+    location ~ js/container_.*_preview\.js$ {
+        expires off;
+        more_set_headers "Cache-Control: private, no-cache, no-store";
+    }
+
+    location ~ \.(gif|ico|jpg|png|svg|js|css|htm|html|mp3|mp4|wav|ogg|avi|ttf|eot|woff|woff2|json)$ {
+        allow all;
+        ## Cache images,CSS,JS and webfonts for an hour
+        ## Increasing the duration may improve the load-time, but may cause old files to show after an Matomo upgrade
+        expires 1h;
+        more_set_headers "Pragma: public";
+        more_set_headers "Cache-Control: public";
+    }
+
+    location ~ ^__PATH__/(libs|vendor|plugins|misc|node_modules) {
+        deny all;
+        return 403;
+    }
+
+    ## properly display textfiles in root directory
+    location ~__PATH__/(.*\.md|LEGALNOTICE|LICENSE) {
+        default_type text/plain;
+    }
+
+    # show YunoHost panel access
     include conf.d/yunohost_panel.conf.inc;
 }

doc/DISCLAIMER.md

@@ -0,0 +1,5 @@
+## Configuration
+
+1. The app will require to complete the registration process after the instllation is complete by **visiting the domain** on  which Matomo is installed.
+1. The MySQL database credentials will be sent to the **admin mail**. Fill these details while doing the registration process.
+1. No LDAP support yet for the app.

doc/DISCLAIMER_fr.md

@@ -0,0 +1,5 @@
+## Configuration
+
+1. Une fois l'installation terminée, l'application devra terminer le processus d'enregistrement en **visitant le domaine** sur lequel Matomo est installé.
+1. Les informations d'identification de la base de données MySQL seront envoyées à **l'email admin**. Remplissez ces détails lors du processus d'inscription.
+1. Le support LDAP n'est pas encore implémenté pour cette l'application.

manifest.json

@@ -6,15 +6,23 @@
         "en": "Open source analytics platform for measuring Web statistics",
         "fr": "Plateforme d'analyse open source de mesure de statistiques Web"
     },
-    "version": "4.2.1~ynh2",
+    "version": "4.3.1~ynh1",
     "url": "https://matomo.org",
+    "upstream": {
+        "license": "GPL-3.0-or-later",
+        "website": "https://matomo.org",
+        "demo": "https://demo.matomo.org",
+        "admindoc": "https://matomo.org/docs",
+        "userdoc": "https://yunohost.org/en/app_matomo",
+        "code": "https://github.com/matomo-org/matomo"
+    },
     "license": "GPL-3.0-or-later",
     "maintainer": {
         "name": "Anmol Sharma",
         "email": "anmol@datamol.org"
     },
     "requirements": {
-        "yunohost": ">= 4.1.7"
+        "yunohost": ">= 4.2.4"
     },
     "multi_instance": true,
     "services": [

pull_request_template.md

@@ -1,16 +0,0 @@
-## Problem
-- *Description of why you made this PR*
-
-## Solution
-- *And how do you fix that problem*
-
-## PR Status
-- [ ] Code finished.
-- [ ] Tested with Package_check.
-- [ ] Fix or enhancement tested.
-- [ ] Upgrade from last version tested.
-- [ ] Can be reviewed and tested.
-
-## Package_check results
----
-* An automatic package_check will be launch at https://ci-apps-dev.yunohost.org/, when you add a specific comment to your Pull Request: "!testme", "!gogogadgetoci" or "By the power of systemd, I invoke The Great App CI to test this Pull Request!"*

scripts/_common.sh

@@ -8,6 +8,9 @@ YNH_PHP_VERSION="7.3"
 
 extra_php_dependencies="php${YNH_PHP_VERSION}-curl php${YNH_PHP_VERSION}-gd php${YNH_PHP_VERSION}-cli php${YNH_PHP_VERSION}-mysql php${YNH_PHP_VERSION}-xml php${YNH_PHP_VERSION}-mbstring"
 
+# Composer version
+YNH_COMPOSER_VERSION="2.0.13"
+
 #=================================================
 # PERSONAL HELPERS
 #=================================================
@@ -76,19 +79,3 @@ $(yunohost tools diagnosis | grep -B 100 "services:" | sed '/services:/d')"
 	# Send the email to the recipients
 	echo "$mail_message" | $mail_bin -a "Content-Type: text/plain; charset=UTF-8" -s "$mail_subject" "$recipients"
 }
-
-
-
-# Execute a command as another user
-# usage: ynh_exec_as USER COMMAND [ARG ...]
-ynh_exec_as() {
-  local USER=$1
-  shift 1
-
-  if [[ $USER = $(whoami) ]]; then
-    eval "$@"
-  else
-    sudo -u "$USER" "$@"
-  fi
-}
-

scripts/change_url

@@ -97,18 +97,10 @@ fi
 #=================================================
 ynh_script_progression --message="Setuping a cron..."
 
-#cp ../conf/cron /etc/cron.d/$app
-
 path=$new_path
 domain=$new_domain
 ynh_add_config --template="../conf/cron" --destination="/etc/cron.d/$app"
 
-# ynh_replace_string --match_string="__FINALPATH__" --replace_string="$final_path" --target_file="/etc/cron.d/$app"
-# ynh_replace_string --match_string="__APP__" --replace_string="$app" --target_file="/etc/cron.d/$app"
-# ynh_replace_string --match_string="__DOMAIN__" --replace_string="$new_domain" --target_file="/etc/cron.d/$app"
-# ynh_replace_string --match_string="__PATH__" --replace_string="$new_path" --target_file="/etc/cron.d/$app"
-# ynh_replace_string --match_string="__PHPVERSION__" --replace_string="$phpversion" --target_file="/etc/cron.d/$app"
-
 #=================================================
 # RELOAD NGINX
 #=================================================

scripts/install

@@ -7,7 +7,6 @@
 #=================================================
 
 source _common.sh
-source ynh_composer__2
 source /usr/share/yunohost/helpers
 
 #=================================================
@@ -62,7 +61,7 @@ ynh_mysql_setup_db --db_user=$db_user --db_name=$db_name
 ynh_script_progression --message="Configuring system user..."
 
 # Create a system user
-ynh_system_user_create --username=$app
+ynh_system_user_create --username=$app --home_dir="$final_path"
 
 #=================================================
 # DOWNLOAD, CHECK AND UNPACK SOURCE
@@ -73,6 +72,11 @@ ynh_app_setting_set --app=$app --key=final_path --value=$final_path
 # Download, check integrity, uncompress and patch the source from app.src
 ynh_setup_source --dest_dir="$final_path"
 
+# Set permissions to app files
+chmod 750 "$final_path"
+chmod -R o-rwx "$final_path"
+chown -R $app:www-data "$final_path"
+
 #=================================================
 # NGINX CONFIGURATION
 #=================================================
@@ -97,7 +101,7 @@ phpversion=$(ynh_app_setting_get --app=$app --key=phpversion)
 #=================================================
 ynh_script_progression --message="Installing Composer and dependencies..."
 
-ynh_install_composer --phpversion="$phpversion" --workdir="$final_path"
+ynh_install_composer
 
 # Install missing icons
 ynh_setup_source --dest_dir="$final_path/plugins/Morpheus/icons" --source_id="icons"
@@ -110,16 +114,6 @@ ynh_script_progression --message="Setuping a cron..."
 
 ynh_add_config --template="../conf/cron" --destination="/etc/cron.d/$app"
 
-#=================================================
-# GENERIC FINALIZATION
-#=================================================
-# SECURE FILES AND DIRECTORIES
-#=================================================
-ynh_script_progression --message="Securing files and directories..."
-
-# Set permissions to app files
-chown -R $app: $final_path
-
 #=================================================
 # SETUP SSOWAT
 #=================================================

scripts/restore

@@ -50,6 +50,14 @@ ynh_script_progression --message="Restoring the NGINX configuration..."
 
 ynh_restore_file --origin_path="/etc/nginx/conf.d/$domain.d/$app.conf"
 
+#=================================================
+# RECREATE THE DEDICATED USER
+#=================================================
+ynh_script_progression --message="Recreating the dedicated system user..."
+
+# Create the dedicated user (if not existing)
+ynh_system_user_create --username=$app --home_dir="$final_path"
+
 #=================================================
 # RESTORE THE APP MAIN DIR
 #=================================================
@@ -57,21 +65,9 @@ ynh_script_progression --message="Restoring Matomo main directory..."
 
 ynh_restore_file --origin_path="$final_path"
 
-#=================================================
+chmod 750 "$final_path"
-# RECREATE THE DEDICATED USER
+chmod -R o-rwx "$final_path"
-#=================================================
+chown -R $app:www-data "$final_path"
-ynh_script_progression --message="Recreating the dedicated system user..."
-
-# Create the dedicated user (if not existing)
-ynh_system_user_create --username=$app
-
-#=================================================
-# RESTORE USER RIGHTS
-#=================================================
-ynh_script_progression --message="Restoring user rights..."
-
-# Restore permissions on app files
-chown -R $app:$app $final_path
 
 #=================================================
 # RESTORE THE PHP-FPM CONFIGURATION

scripts/upgrade

@@ -7,7 +7,6 @@
 #=================================================
 
 source _common.sh
-source ynh_composer__2
 source /usr/share/yunohost/helpers
 
 #=================================================
@@ -54,6 +53,14 @@ if ynh_legacy_permissions_exists; then
 	ynh_app_setting_delete --app=$app --key=is_public
 fi
 
+#=================================================
+# CREATE DEDICATED USER
+#=================================================
+ynh_script_progression --message="Making sure dedicated system user exists..."
+
+# Create a dedicated user (if not existing)
+ynh_system_user_create --username=$app --home_dir="$final_path"
+
 #=================================================
 # BACKUP BEFORE UPGRADE THEN ACTIVE TRAP
 #=================================================
@@ -82,30 +89,17 @@ then
 		# config.ini.php is only created during the post-install process...
 		# it is therefore not present when the CI tests are carried out...
 		# This condition is only for CI test to go through the upgrade process
-		ynh_secure_remove --file="$final_path"
-		# Download, check integrity, uncompress and patch the source from app.src
 		ynh_setup_source --dest_dir="$final_path"
 	else
-		# Create a temporary directory
-		tmpdir="$(mktemp -d)"
-
-		# Backup the config file in the temp dir
-		cp -a "$final_path/config/config.ini.php" "$tmpdir/config.ini.php"
-
-		# Remove the app directory securely
-		ynh_secure_remove --file="$final_path"
-
 		# Download, check integrity, uncompress and patch the source from app.src
-		ynh_setup_source --dest_dir="$final_path" #--keep="foo bar" to integrate when https://github.com/YunoHost/yunohost/pull/1200 is upstream
+		ynh_setup_source --dest_dir="$final_path" --keep="$final_path/config/config.ini.php"
-
-		# Copy the admin saved settings from tmp directory to final path	
-		cp -a "$tmpdir/config.ini.php" "$final_path/config/config.ini.php" 
-
-		# Remove the tmp directory securely
-		ynh_secure_remove --file="$tmpdir"
 	fi
 fi
 
+chmod 750 "$final_path"
+chmod -R o-rwx "$final_path"
+chown -R $app:www-data "$final_path"
+
 #=================================================
 # NGINX CONFIGURATION
 #=================================================
@@ -114,14 +108,6 @@ ynh_script_progression --message="Upgrading NGINX web server configuration..."
 # Create a dedicated NGINX config
 ynh_add_nginx_config
 
-#=================================================
-# CREATE DEDICATED USER
-#=================================================
-ynh_script_progression --message="Making sure dedicated system user exists..."
-
-# Create a dedicated user (if not existing)
-ynh_system_user_create --username=$app
-
 #=================================================
 # PHP-FPM CONFIGURATION
 #=================================================
@@ -137,10 +123,12 @@ ynh_add_fpm_config --usage=low --footprint=low --package="$extra_php_dependencie
 #=================================================
 ynh_script_progression --message="Installating composer and dependencies..."
 
-ynh_install_composer --phpversion="$phpversion" --workdir="$final_path"
+if [ "$upgrade_type" == "UPGRADE_APP" ]
-
+then
-if [[ -f "$final_path/config/config.ini.php" ]]; then
+	ynh_install_composer --phpversion="$phpversion" --workdir="$final_path"
-	php$phpversion $final_path/console core:update
+	if [[ -f "$final_path/config/config.ini.php" ]]; then
+	php$phpversion $final_path/console core:update -n
+	fi
 fi
 
 #=================================================
@@ -161,16 +149,6 @@ ynh_script_progression --message="Setuping a cron..."
 
 ynh_add_config --template="../conf/cron" --destination="/etc/cron.d/$app"
 
-#=================================================
-# GENERIC FINALIZATION
-#=================================================
-# SECURE FILES AND DIRECTORIES
-#=================================================
-ynh_script_progression --message="Securing files and directories..."
-
-# Set permissions on app files
-chown -R $app: $final_path
-
 #=================================================
 # RELOAD NGINX
 #=================================================

scripts/ynh_composer__2

@@ -1,53 +0,0 @@
-#!/bin/bash
-
-# Execute a command with Composer
-#
-# usage: ynh_composer_exec [--phpversion=phpversion] [--workdir=$final_path] --commands="commands"
-# | arg: -v, --phpversion - PHP version to use with composer
-# | arg: -w, --workdir - The directory from where the command will be executed. Default $final_path.
-# | arg: -c, --commands - Commands to execute.
-ynh_composer_exec () {
-	# Declare an array to define the options of this helper.
-	local legacy_args=vwc
-	declare -Ar args_array=( [v]=phpversion= [w]=workdir= [c]=commands= )
-	local phpversion
-	local workdir
-	local commands
-	# Manage arguments with getopts
-	ynh_handle_getopts_args "$@"
-	workdir="${workdir:-$final_path}"
-	phpversion="${phpversion:-$YNH_PHP_VERSION}"
-
-	COMPOSER_HOME="$workdir/.composer" \
-		php${phpversion} "$workdir/composer.phar" $commands \
-		-d "$workdir" --quiet --no-interaction
-}
-
-# Install and initialize Composer in the given directory
-#
-# usage: ynh_install_composer [--phpversion=phpversion] [--workdir=$final_path] [--install_args="--optimize-autoloader"]
-# | arg: -v, --phpversion - PHP version to use with composer
-# | arg: -w, --workdir - The directory from where the command will be executed. Default $final_path.
-# | arg: -a, --install_args - Additional arguments provided to the composer install. Argument --no-dev already include
-ynh_install_composer () {
-	# Declare an array to define the options of this helper.
-	local legacy_args=vwa
-	declare -Ar args_array=( [v]=phpversion= [w]=workdir= [a]=install_args=)
-	local phpversion
-	local workdir
-	local install_args
-	# Manage arguments with getopts
-	ynh_handle_getopts_args "$@"
-	workdir="${workdir:-$final_path}"
-	phpversion="${phpversion:-$YNH_PHP_VERSION}"
-	install_args="${install_args:-}"
-
-	curl -sS https://getcomposer.org/installer \
-		| COMPOSER_HOME="$workdir/.composer" \
-		php${phpversion} -- --quiet --install-dir="$workdir" \
-		|| ynh_die "Unable to install Composer."
-
-	# update dependencies to create composer.lock
-	ynh_composer_exec --phpversion="${phpversion}" --workdir="$workdir" --commands="install --no-dev $install_args" \
-		|| ynh_die "Unable to update core dependencies with Composer."
-}