0.19.1 (#33)

* 0.19.1

README.md

@@ -17,7 +17,7 @@ If you don't have YunoHost, please consult [the guide](https://yunohost.org/#/in
 
 Web-based cross-platform XMPP client
 
-**Shipped version:** 0.19~ynh2
+**Shipped version:** 0.19.1~ynh1
 
 **Demo:** https://nl.movim.eu/?login
 

README_fr.md

@@ -13,7 +13,7 @@ Si vous n'avez pas YunoHost, regardez [ici](https://yunohost.org/#/install) pour
 
 Client XMPP multiplateforme basé sur le Web
 
-**Version incluse :** 0.19~ynh2
+**Version incluse :** 0.19.1~ynh1
 
 **Démo :** https://nl.movim.eu/?login
 

conf/app.src

@@ -1,5 +1,5 @@
-SOURCE_URL=https://github.com/movim/movim/archive/v0.19.tar.gz
+SOURCE_URL=https://github.com/movim/movim/archive/refs/tags/v0.19.1rc5.tar.gz
-SOURCE_SUM=df98b5b0df6fd6bfa5fda88f387ac017bc7bcead42c462745296604f3e0ee501
+SOURCE_SUM=48240577116edf6df6da1daceee78c2a50037f86a1a9349071cc18390dd82b8c
 SOURCE_SUM_PRG=sha256sum
 SOURCE_FORMAT=tar.gz
 SOURCE_IN_SUBDIR=true

conf/systemd.service

@@ -13,5 +13,36 @@ PIDFile=/run/movim.pid
 Restart=on-failure
 RestartSec=10
 
+
+# Sandboxing options to harden security
+# Depending on specificities of your service/app, you may need to tweak these 
+# .. but this should be a good baseline
+# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+RestrictNamespaces=yes
+RestrictRealtime=yes
+DevicePolicy=closed
+ProtectSystem=full
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+LockPersonality=yes
+SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
+
+# Denying access to capabilities that should not be relevant for webapps
+# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
+CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
+CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
+CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
+CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
+CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
+CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
+CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
+CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
+CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG 
+
 [Install]
 WantedBy=multi-user.target

manifest.json

@@ -6,7 +6,7 @@
         "en": "Web-based cross-platform XMPP client",
         "fr": "Client XMPP multiplateforme basé sur le Web"
     },
-    "version": "0.19~ynh2",
+    "version": "0.19.1~ynh1",
     "url": "https://movim.eu",
      "upstream": {
         "license": "AGPL-3.0-or-later",
@@ -48,11 +48,6 @@
                 "type": "user",
                 "example": "johndoe"
             },
-            {
-                "name": "password",
-                "type": "password",
-                "example": "Choose a password"
-            },
             {
                 "name": "is_public",
                 "type": "boolean",

scripts/install

@@ -24,8 +24,8 @@ domain=$YNH_APP_ARG_DOMAIN
 path_url=$YNH_APP_ARG_PATH
 admin=$YNH_APP_ARG_ADMIN
 is_public=$YNH_APP_ARG_IS_PUBLIC
-password=$YNH_APP_ARG_PASSWORD
 timezone=$(cat /etc/timezone)
+maindomain=$(yunohost domain main-domain --output-as plain)
 
 app=$YNH_APP_INSTANCE_NAME
 
@@ -130,7 +130,7 @@ ynh_script_progression --message="Modifying a config file..." --weight=1
 ynh_add_config --template="../conf/db.example.inc.php" --destination="$final_path/config/db.inc.php"
 
 chmod 400 "$final_path/config/db.inc.php"
-chown $app:$app "$final_path/config/db.inc.php"
+chown $app "$final_path/config/db.inc.php"
 
 #=================================================
 # Install PHP dependencies using composer
@@ -158,7 +158,7 @@ chown -R $app $cache_dir
 
 pushd $final_path
 	php$phpversion composer.phar $app:migrate --quiet
-	php$phpversion daemon.php config --username=$admin --password=$password --quiet
+	#php$phpversion daemon.php setAdmin $admin@${maindomain}
 popd
 
 #=================================================

scripts/remove

@@ -81,7 +81,7 @@ ynh_secure_remove --file="$final_path"
 ynh_script_progression --message="Removing Movim cache directory..." --weight=6
 
 # Remove the app directory securely
-ynh_secure_remove --file="/home/$app"
+ynh_secure_remove --file="/home/yunohost.app/$app"
 
 #=================================================
 # REMOVE PHP-FPM CONFIGURATION

scripts/restore

@@ -40,8 +40,6 @@ phpversion=$(ynh_app_setting_get --app=$app --key=phpversion)
 #=================================================
 ynh_script_progression --message="Validating restoration parameters..." --weight=2
 
-ynh_webpath_available --domain=$domain --path_url=$path_url \
-	|| ynh_die --message="Path not available: ${domain}${path_url}"
 test ! -d $final_path \
 	|| ynh_die --message="There is already a directory: $final_path "