Merge pull request #31 from YunoHost-Apps/testing

update to SPIP v3.2.11

.github/ISSUE_TEMPLATE.md

@@ -0,0 +1,55 @@
+---
+name: Bug report
+about: When creating a bug report, please use the following template to provide all the relevant information and help debugging efficiently.
+
+---
+
+**How to post a meaningful bug report**
+1. *Read this whole template first.*
+2. *Determine if you are on the right place:*
+   - *If you were performing an action on the app from the webadmin or the CLI (install, update, backup, restore, change_url...), you are on the right place!*
+   - *Otherwise, the issue may be due to the app itself. Refer to its documentation or repository for help.*
+   - *When in doubt, post here and we will figure it out together.*
+3. *Delete the italic comments as you write over them below, and remove this guide.*
+--- 
+
+### Describe the bug
+
+*A clear and concise description of what the bug is.*
+
+### Context
+
+- Hardware: *VPS bought online / Old laptop or computer / Raspberry Pi at home / Internet Cube with VPN / Other ARM board / ...*
+- YunoHost version: x.x.x
+- I have access to my server: *Through SSH | through the webadmin | direct access via keyboard / screen | ...*
+- Are you in a special context or did you perform some particular tweaking on your YunoHost instance?: *no / yes*
+  - If yes, please explain:
+- Using, or trying to install package version/branch:
+- If upgrading, current package version: *can be found in the admin, or with `yunohost app info $app_id`*
+
+### Steps to reproduce
+
+- *If you performed a command from the CLI, the command itself is enough. For example:*
+    ```sh
+    sudo yunohost app install the_app
+    ```
+- *If you used the webadmin, please perform the equivalent command from the CLI first.*
+- *If the error occurs in your browser, explain what you did:*
+   1. *Go to '...'*
+   2. *Click on '...'*
+   3. *Scroll down to '...'*
+   4. *See error*
+
+### Expected behavior
+
+*A clear and concise description of what you expected to happen. You can remove this section if the command above is enough to understand your intent.*
+
+### Logs
+
+*When an operation fails, YunoHost provides a simple way to share the logs.*
+- *In the webadmin, the error message contains a link to the relevant log page. On that page, you will be able to 'Share with Yunopaste'. If you missed it, the logs of previous operations are also available under Tools > Logs.*
+- *In command line, the command to share the logs is displayed at the end of the operation and looks like `yunohost log display [log name] --share`. If you missed it, you can find the log ID of a previous operation using `yunohost log list`.*
+
+*After sharing the log, please copypaste directly the link provided by YunoHost (to help readability, no need to copypaste the entire content of the log here, just the link is enough...)*
+
+*If applicable and useful, add screenshots to help explain your problem.*

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,16 @@
+## Problem
+
+- *Description of why you made this PR*
+
+## Solution
+
+- *And how do you fix that problem*
+
+## PR Status
+
+- [ ] Code finished and ready to be reviewed/tested
+- [ ] The fix/enhancement were manually tested (if applicable)
+
+## Automatic tests
+
+Automatic tests can be triggered on https://ci-apps-dev.yunohost.org/ *after creating the PR*, by commenting "!testme", "!gogogadgetoci" or "By the power of systemd, I invoke The Great App CI to test this Pull Request!". (N.B. : for this to work you need to be a member of the Yunohost-Apps organization)

README.md

@@ -14,7 +14,7 @@ SPIP is a publishing system for the Internet in which great importance is attach
 
 Source: [spip.net](http://www.spip.net/en_rubrique25.html)
 
-**Shipped version:** 3.2.9
+**Shipped version:** 3.2.11
 
 ## Screenshots
 

README_fr.md

@@ -14,7 +14,7 @@ SPIP est un système de publication pour l’Internet qui s’attache particuli
 
 Source: [spip.net](http://www.spip.net/fr_rubrique91.html)
 
-**Version incluse:** 3.2.9
+**Version incluse:** 3.2.11
 
 ## Captures d'écran
 

check_process

@@ -14,12 +14,36 @@
 		setup_private=1
 		setup_public=1
 		upgrade=1
-		upgrade=1	from_commit=2016c3a3a972dc74d1ae1ec74ff80987eb753ce9
+		# 3.2.4~ynh1
+		#upgrade=1	from_commit=e079b0d81e698c9cde7e9ce50b29da1d5715bf65
+		# 3.2.5~ynh1
+		#upgrade=1	from_commit=bf4e4ecbed70de828d0a0828f3240febb25dde0e
+		# 3.2.7~ynh2
+		upgrade=1	from_commit=a13cdbc22324173e983cf8c358920615d8c10e64
+		# 3.2.7~ynh3
+		upgrade=1	from_commit=69521e339ffc50e4960968b63d2aee8ffe81f854
+		# 3.2.8~ynh1
+		upgrade=1	from_commit=810fd850466139fe4b7ee31eabc13d81d4020698
+		# 3.2.8~ynh2
+		upgrade=1	from_commit=0d7e9e61e95d2ad6e1443566d2c45325730fd29b
+		# 3.2.9~ynh2
+		upgrade=1	from_commit=7cb55ab7365af2c52b3c709127da860b87f932fc
 		backup_restore=1
 		multi_instance=1
 		port_already_use=0
 		change_url=1
 ;;; Upgrade options
-	; commit=2016c3a3a972dc74d1ae1ec74ff80987eb753ce9
+	; commit=e079b0d81e698c9cde7e9ce50b29da1d5715bf65
-		name=21 Nov 2017
+		name=3.2.4~ynh1
-		manifest_arg=domain=DOMAIN&path=PATH&admin=USER&language=fr_FR&is_public="Yes"&ldap=No
+	; commit=bf4e4ecbed70de828d0a0828f3240febb25dde0e
+		name=3.2.5~ynh1
+	; commit=a13cdbc22324173e983cf8c358920615d8c10e64
+		name=3.2.7~ynh2
+	; commit=69521e339ffc50e4960968b63d2aee8ffe81f854
+		name=3.2.7~ynh3
+	; commit=810fd850466139fe4b7ee31eabc13d81d4020698
+		name=3.2.8~ynh1
+	; commit=0d7e9e61e95d2ad6e1443566d2c45325730fd29b
+		name=3.2.8~ynh2
+	; commit=7cb55ab7365af2c52b3c709127da860b87f932fc
+		name=3.2.9~ynh2

conf/app.src

@@ -1,6 +1,7 @@
-SOURCE_URL=https://files.spip.net/spip/archives/spip-v3.2.9.zip
+SOURCE_URL=https://files.spip.net/spip/archives/spip-v3.2.11.zip
-SOURCE_SUM=1a238e8674a4921db71c89ddaac35f82ff0d532f89ad2feef321ea6b9f8cc759
+SOURCE_SUM=6b713ec10d9ceff367ec7f76f32d9438b76919f493cae3ef3a3db0cfce570df3
 SOURCE_SUM_PRG=sha256sum
 SOURCE_FORMAT=zip
 SOURCE_IN_SUBDIR=false
 SOURCE_FILENAME=
+SOURCE_EXTRACT=true

manifest.json

@@ -6,7 +6,7 @@
         "en": "CMS with a focus on collaborative edition and multilingualism",
         "fr": "CMS conçu pour l'édition collaborative et le multilinguisme"
     },
-	"version": "3.2.9~ynh2",
+    "version": "3.2.11~ynh2",
     "url": "http://www.spip.net/",
     "license": "GPL-3.0-or-later",
     "maintainer": {
@@ -14,7 +14,7 @@
         "email": "cyp@rouquin.me"
     },
     "requirements": {
-		"yunohost": ">= 3.8.1"
+        "yunohost": ">= 4.1.0"
     },
     "multi_instance": true,
     "services": [
@@ -26,46 +26,27 @@
             {
                 "name": "domain",
                 "type": "domain",
-				"ask": {
+                "example": "example.com"
-					"en": "Choose a domain name for SPIP",
-					"fr": "Choisissez un nom de domaine pour SPIP"
-				},
-				"example": "example.org"
             },
             {
                 "name": "path",
                 "type": "path",
-				"ask": {
-					"en": "Choose a path for SPIP",
-					"fr": "Choisissez un chemin pour SPIP"
-				},
                 "example": "/spip",
                 "default": "/spip"
             },
             {
                 "name": "admin",
                 "type": "user",
-				"ask": {
-					"en": "Choose the SPIP administrator (must be an existing YunoHost user)",
-					"fr": "Administrateur du site (doit être un utilisateur YunoHost existant)"
-				},
                 "example": "johndoe"
             },
             {
                 "name": "password",
                 "type": "password",
-				"ask": {
+                "example": "Choose a password"
-					"en": "Choose the SPIP password for the administrator",
-					"fr": "Choisissez un mot de passe pour l'administrateur"
-				}
             },
             {
                 "name": "is_public",
                 "type": "boolean",
-				"ask": {
-					"en": "Is it a public SPIP site?",
-					"fr": "Est-ce un site public ?"
-				},
                 "default": true
             },
             {

scripts/backup

@@ -6,7 +6,7 @@
 # IMPORT GENERIC HELPERS
 #=================================================
 
-#Keep this path for calling _common.sh inside the execution's context of backup and restore scripts
+# Keep this path for calling _common.sh inside the execution's context of backup and restore scripts
 source ../settings/scripts/_common.sh
 source /usr/share/yunohost/helpers
 
@@ -15,7 +15,6 @@ source /usr/share/yunohost/helpers
 #=================================================
 
 ynh_clean_setup () {
-	### Remove this function if there's nothing to clean before calling the remove script.
 	true
 }
 # Exit if an error occurs during the execution of the script
@@ -59,6 +58,7 @@ ynh_backup --src_path="/etc/php/$phpversion/fpm/pool.d/$app.conf"
 #=================================================
 # BACKUP THE MYSQL DATABASE
 #=================================================
+ynh_print_info --message="Backing up the MySQL database..."
 
 ynh_mysql_dump_db --database="$db_name" > db.sql
 

scripts/change_url

@@ -27,16 +27,24 @@ app=$YNH_APP_INSTANCE_NAME
 ynh_script_progression --message="Loading installation settings..."
 
 # Needed for helper "ynh_add_nginx_config"
-final_path=$(ynh_app_setting_get $app final_path)
+final_path=$(ynh_app_setting_get --app=$app --key=final_path)
 
 #=================================================
-# CHECK THE SYNTAX OF THE PATHS
+# BACKUP BEFORE CHANGE URL THEN ACTIVE TRAP
 #=================================================
+ynh_script_progression --message="Backing up the app before changing its URL (may take a while)..."
 
-test -n "$old_path" || old_path="/"
+# Backup the current version of the app
-test -n "$new_path" || new_path="/"
+ynh_backup_before_upgrade
-new_path=$(ynh_normalize_url_path $new_path)
+ynh_clean_setup () {
-old_path=$(ynh_normalize_url_path $old_path)
+	# Remove the new domain config file, the remove script won't do it as it doesn't know yet its location.
+	ynh_secure_remove --file="/etc/nginx/conf.d/$new_domain.d/$app.conf"
+
+	# Restore it if the upgrade fails
+	ynh_restore_upgradebackup
+}
+# Exit if an error occurs during the execution of the script
+ynh_abort_if_errors
 
 #=================================================
 # CHECK WHICH PARTS SHOULD BE CHANGED
@@ -63,19 +71,19 @@ ynh_script_progression --message="Updating NGINX web server configuration..."
 
 nginx_conf_path=/etc/nginx/conf.d/$old_domain.d/$app.conf
 
-# Change the path in the nginx config file
+# Change the path in the NGINX config file
 if [ $change_path -eq 1 ]
 then
-	# Make a backup of the original nginx config file if modified
+	# Make a backup of the original NGINX config file if modified
 	ynh_backup_if_checksum_is_different --file="$nginx_conf_path"
-	# Set global variables for nginx helper
+	# Set global variables for NGINX helper
 	domain="$old_domain"
 	path_url="$new_path"
-	# Create a dedicated nginx config
+	# Create a dedicated NGINX config
 	ynh_add_nginx_config
 fi
 
-# Change the domain for nginx
+# Change the domain for NGINX
 if [ $change_domain -eq 1 ]
 then
 	# Delete file checksum for the old conf file location

scripts/install

@@ -13,8 +13,7 @@ source /usr/share/yunohost/helpers
 # MANAGE SCRIPT FAILURE
 #=================================================
 
-ynh_clean_setup() {
+ynh_clean_setup () {
-	### Remove this function if there's nothing to clean before calling the remove script.
 	true
 }
 # Exit if an error occurs during the execution of the script
@@ -27,8 +26,8 @@ ynh_abort_if_errors
 domain=$YNH_APP_ARG_DOMAIN
 path_url=$YNH_APP_ARG_PATH
 admin=$YNH_APP_ARG_ADMIN
-password=$YNH_APP_ARG_PASSWORD
 is_public=$YNH_APP_ARG_IS_PUBLIC
+password=$YNH_APP_ARG_PASSWORD
 users_status=$YNH_APP_ARG_USERS_STATUS
 
 app=$YNH_APP_INSTANCE_NAME
@@ -56,14 +55,23 @@ ynh_app_setting_set --app=$app --key=password --value=$password
 ynh_app_setting_set --app=$app --key=is_public --value=$is_public
 ynh_app_setting_set --app=$app --key=users_status --value=$users_status
 
+#=================================================
+# CREATE DEDICATED USER
+#=================================================
+ynh_script_progression --message="Configuring system user..."
+
+# Create a system user
+ynh_system_user_create --username=$app --home_dir=$final_path
+
 #=================================================
 # CREATE A MYSQL DATABASE
 #=================================================
 ynh_script_progression --message="Creating a MySQL database..."
 
 db_name=$(ynh_sanitize_dbid --db_name=$app)
+db_user=$db_name
 ynh_app_setting_set --app=$app --key=db_name --value=$db_name
-ynh_mysql_setup_db --db_user=$db_name --db_name=$db_name
+ynh_mysql_setup_db --db_user=$db_user --db_name=$db_name
 db_pwd=$(ynh_app_setting_get --app=$app --key=mysqlpwd)
 
 #=================================================
@@ -75,28 +83,24 @@ ynh_app_setting_set --app=$app --key=final_path --value=$final_path
 # Download, check integrity, uncompress and patch the source from app.src
 ynh_setup_source --dest_dir="$final_path"
 
+chmod 750 "$final_path"
+chmod -R o-rwx "$final_path"
+chown -R $app:www-data "$final_path"
+
 #=================================================
 # NGINX CONFIGURATION
 #=================================================
 ynh_script_progression --message="Configuring NGINX web server..."
 
-# Create a dedicated nginx config
+# Create a dedicated NGINX config
 ynh_add_nginx_config
 
-#=================================================
-# CREATE DEDICATED USER
-#=================================================
-ynh_script_progression --message="Configuring system user..."
-
-# Create a system user
-ynh_system_user_create --username=$app
-
 #=================================================
 # PHP-FPM CONFIGURATION
 #=================================================
 ynh_script_progression --message="Configuring PHP-FPM..."
 
-# Create a dedicated php-fpm config
+# Create a dedicated PHP-FPM config
 ynh_add_fpm_config --package="$extra_php_dependencies"
 
 #=================================================
@@ -104,19 +108,18 @@ ynh_add_fpm_config --package="$extra_php_dependencies"
 #=================================================
 # SETUP APPLICATION WITH CURL
 #=================================================
+ynh_script_progression --message="Setuping application with CURL..."
 
 # Set right permissions for curl install
 mkdir -p $final_path/plugins/auto
-chown -R $app: $final_path
+chown -R $app:www-data "$final_path"
 
 # Set the app as temporarily public for curl call
-ynh_app_setting_set --app=$app --key=skipped_uris --value="/"
+ynh_script_progression --message="Configuring SSOwat..."
-# Reload SSOwat config
+# Making the app public for curl
-yunohost app ssowatconf
+ynh_permission_update --permission="main" --add="visitors"
-
-# Reload Nginx
-ynh_systemd_action --service_name=nginx --action=reload
 
+# Installation with curl
 ynh_script_progression --message="Finalizing installation..."
 ynh_local_curl "/ecrire/?suivant" "exec=install" "etape=chmod"
 ynh_local_curl "/ecrire/?suivant" "exec=install" "etape=2" "chmod=755" "adresse_db=localhost" "login_db=$db_name" "pass_db=$db_pwd" "server_db=mysql"
@@ -145,7 +148,8 @@ email=$(yunohost user info $admin | grep mail: | cut -d' ' -f2 | tr -d '\n')
 ynh_local_curl "/ecrire/?suivant" "exec=install" "etape=3b" "adresse_db=localhost" "login_db=$db_name" "pass_db=$db_pwd" "server_db=mysql" "sel_db=$db_name" "nom=$admin" "email=$email" "login=$admin" "pass=$password" "pass_verif=$password"
 ynh_local_curl "/ecrire/?suivant" "exec=install" "etape=fin"
 
-ynh_app_setting_delete --app=$app --key=skipped_uris
+# Remove the public access
+ynh_permission_update --permission="main" --remove="visitors"
 
 #=================================================
 # MODIFY A CONFIG FILE
@@ -162,19 +166,17 @@ ynh_store_file_checksum --file="$final_path/config/connect.php"
 
 #=================================================
 # GENERIC FINALIZATION
-#=================================================
-# ADVERTISE SERVICE IN ADMIN PANEL
-#=================================================
-
 #=================================================
 # SETUP SSOWAT
 #=================================================
-ynh_script_progression --message="Configuring SSOwat..."
+ynh_script_progression --message="Configuring permissions..."
 
 # Make app public if necessary
-if [ $is_public -eq 1 ]; then
+if [ $is_public -eq 1 ]
-	# unprotected_uris allows SSO credentials to be passed anyway.
+then
-	ynh_app_setting_set --app=$app --key=unprotected_uris --value="/"
+	# Everyone can access the app.
+	# The "main" permission is automatically created before the install script.
+	ynh_permission_update --permission="main" --add="visitors"
 fi
 
 #=================================================

scripts/remove

@@ -26,7 +26,7 @@ final_path=$(ynh_app_setting_get --app=$app --key=final_path)
 #=================================================
 # STOP AND REMOVE SERVICE
 #=================================================
-ynh_script_progression --message="Stopping and removing the systemd service"
+ynh_script_progression --message="Stopping and removing the systemd service..."
 
 # Remove the dedicated systemd config
 ynh_remove_systemd_config
@@ -34,10 +34,10 @@ ynh_remove_systemd_config
 #=================================================
 # REMOVE THE MYSQL DATABASE
 #=================================================
-ynh_script_progression --message="Stopping and removing the systemd service"
+ynh_script_progression --message="Removing the MySQL database..."
 
 # Remove a database if it exists, along with the associated user
-ynh_mysql_remove_db --db_user=$db_name --db_name=$db_name
+ynh_mysql_remove_db --db_user=$db_user --db_name=$db_name
 
 #=================================================
 # REMOVE APP MAIN DIR
@@ -52,7 +52,7 @@ ynh_secure_remove --file="$final_path"
 #=================================================
 ynh_script_progression --message="Removing NGINX web server configuration..."
 
-# Remove the dedicated nginx config
+# Remove the dedicated NGINX config
 ynh_remove_nginx_config
 
 #=================================================
@@ -60,7 +60,7 @@ ynh_remove_nginx_config
 #=================================================
 ynh_script_progression --message="Removing PHP-FPM configuration..."
 
-# Remove the dedicated php-fpm config
+# Remove the dedicated PHP-FPM config
 ynh_remove_fpm_config
 
 #=================================================

scripts/restore

@@ -6,7 +6,7 @@
 # IMPORT GENERIC HELPERS
 #=================================================
 
-#Keep this path for calling _common.sh inside the execution's context of backup and restore scripts
+# Keep this path for calling _common.sh inside the execution's context of backup and restore scripts
 source ../settings/scripts/_common.sh
 source /usr/share/yunohost/helpers
 
@@ -15,7 +15,6 @@ source /usr/share/yunohost/helpers
 #=================================================
 
 ynh_clean_setup () {
-	#### Remove this function if there's nothing to clean before calling the remove script.
 	true
 }
 # Exit if an error occurs during the execution of the script
@@ -24,7 +23,7 @@ ynh_abort_if_errors
 #=================================================
 # LOAD SETTINGS
 #=================================================
-ynh_script_progression --message="Loading settings..."
+ynh_script_progression --message="Loading installation settings..."
 
 app=$YNH_APP_INSTANCE_NAME
 
@@ -32,6 +31,7 @@ domain=$(ynh_app_setting_get --app=$app --key=domain)
 path_url=$(ynh_app_setting_get --app=$app --key=path)
 final_path=$(ynh_app_setting_get --app=$app --key=final_path)
 db_name=$(ynh_app_setting_get --app=$app --key=db_name)
+db_user=$db_name
 phpversion=$(ynh_app_setting_get --app=$app --key=phpversion)
 
 #=================================================
@@ -49,9 +49,18 @@ test ! -d $final_path \
 #=================================================
 # RESTORE THE NGINX CONFIGURATION
 #=================================================
+ynh_script_progression --message="Restoring the NGINX configuration..."
 
 ynh_restore_file --origin_path="/etc/nginx/conf.d/$domain.d/$app.conf"
 
+#=================================================
+# RECREATE THE DEDICATED USER
+#=================================================
+ynh_script_progression --message="Recreating the dedicated system user..."
+
+# Create the dedicated user (if not existing)
+ynh_system_user_create --username=$app --home_dir=$final_path
+
 #=================================================
 # RESTORE THE APP MAIN DIR
 #=================================================
@@ -59,24 +68,14 @@ ynh_script_progression --message="Restoring the app main directory..."
 
 ynh_restore_file --origin_path="$final_path"
 
-#=================================================
+chmod 750 "$final_path"
-# RECREATE THE DEDICATED USER
+chmod -R o-rwx "$final_path"
-#=================================================
+chown -R $app:www-data "$final_path"
-ynh_script_progression --message="Recreating the dedicated system user..."
-
-# Create the dedicated user (if not existing)
-ynh_system_user_create --username=$app
-
-#=================================================
-# RESTORE USER RIGHTS
-#=================================================
-
-# Restore permissions on app files
-chown -R $app: $final_path
 
 #=================================================
 # RESTORE THE PHP-FPM CONFIGURATION
 #=================================================
+ynh_script_progression --message="Restoring the PHP-FPM configuration..."
 
 # Restore the file first, so it can have a backup if different
 ynh_restore_file --origin_path="/etc/php/$phpversion/fpm/pool.d/$app.conf"
@@ -93,8 +92,8 @@ ynh_add_fpm_config --phpversion=$phpversion --package="$extra_php_dependencies"
 ynh_script_progression --message="Restoring the MySQL database..."
 
 db_pwd=$(ynh_app_setting_get --app=$app --key=mysqlpwd)
-ynh_mysql_setup_db --db_user=$db_name --db_name=$db_name --db_pwd=$db_pwd
+ynh_mysql_setup_db --db_user=$db_user --db_name=$db_name --db_pwd=$db_pwd
-ynh_mysql_connect_as --user=$db_name --password=$db_pwd --database=$db_name < ./db.sql
+ynh_mysql_connect_as --user=$db_user --password=$db_pwd --database=$db_name < ./db.sql
 
 #=================================================
 # GENERIC FINALIZATION
@@ -103,11 +102,11 @@ ynh_mysql_connect_as --user=$db_name --password=$db_pwd --database=$db_name < ./
 #=================================================
 ynh_script_progression --message="Reloading NGINX web server and PHP-FPM..."
 
-ynh_systemd_action --service_name=php${phpversion}-fpm --action=reload
+ynh_systemd_action --service_name=php$phpversion-fpm --action=reload
 ynh_systemd_action --service_name=nginx --action=reload
 
 #=================================================
 # END OF SCRIPT
 #=================================================
 
-ynh_print_info "Restoration completed for $app"
+ynh_script_progression --message="Restoration completed for $app"

scripts/upgrade

@@ -24,8 +24,37 @@ is_public=$(ynh_app_setting_get --app=$app --key=is_public)
 final_path=$(ynh_app_setting_get --app=$app --key=final_path)
 users_status=$(ynh_app_setting_get --app=$app --key=users_status)
 db_name=$(ynh_app_setting_get --app=$app --key=db_name)
+db_user=$db_name
 db_pwd=$(ynh_app_setting_get --app=$app --key=mysqlpwd)
 
+#=================================================
+# CHECK VERSION
+#=================================================
+ynh_script_progression --message="Checking version..."
+
+upgrade_type=$(ynh_check_app_version_changed)
+
+#=================================================
+# BACKUP BEFORE UPGRADE THEN ACTIVE TRAP
+#=================================================
+ynh_script_progression --message="Backing up the app before upgrading (may take a while)..."
+
+# Backup the current version of the app
+ynh_backup_before_upgrade
+ynh_clean_setup () {
+	if [ $migration_process -eq 1 ]; then
+		yunohost app remove $app
+		# Reload some values changed by the migration process
+		app=$YNH_APP_INSTANCE_NAME
+	fi
+	# Restore it if the upgrade fails
+	ynh_restore_upgradebackup
+}
+# Exit if an error occurs during the execution of the script
+ynh_abort_if_errors
+
+#=================================================
+# STANDARD UPGRADE STEPS
 #=================================================
 # ENSURE DOWNWARD COMPATIBILITY
 #=================================================
@@ -71,24 +100,10 @@ if [ -z $password ]; then
 	ynh_app_setting_set --app=$app --key=password --value=$password
 fi
 
-#=================================================
+# Cleaning legacy permissions
-# BACKUP BEFORE UPGRADE THEN ACTIVE TRAP
+if ynh_legacy_permissions_exists; then
-#=================================================
+	ynh_legacy_permissions_delete_all
-ynh_script_progression --message="Backing up the app before upgrading (may take a while)..."
+fi
-
-# Backup the current version of the app
-ynh_backup_before_upgrade
-ynh_clean_setup () {
-	if [ $migration_process -eq 1 ]; then
-		yunohost app remove $app
-		# Reload some values changed by the migration process
-		app=$YNH_APP_INSTANCE_NAME
-	fi
-	# restore it if the upgrade fails
-	ynh_restore_upgradebackup
-}
-# Exit if an error occurs during the execution of the script
-ynh_abort_if_errors
 
 #=================================================
 # HANDLE MIGRATION FROM SPIP2
@@ -103,37 +118,43 @@ if [ $migration_process -eq 1 ]; then
 fi
 
 #=================================================
-# STANDARD UPGRADE STEPS
+# CREATE DEDICATED USER
+#=================================================
+ynh_script_progression --message="Making sure dedicated system user exists..."
+
+# Create a dedicated user (if not existing)
+ynh_system_user_create --username=$app --home_dir=$final_path
+
 #=================================================
 # DOWNLOAD, CHECK AND UNPACK SOURCE
 #=================================================
-ynh_script_progression --message="Upgrading source files..."
 
-# Download, check integrity, uncompress and patch the source from app.src
+if [ "$upgrade_type" == "UPGRADE_APP" ]
-ynh_setup_source --dest_dir="$final_path"
+then
+	ynh_script_progression --message="Upgrading source files..."
+
+	# Download, check integrity, uncompress and patch the source from app.src
+	ynh_setup_source --dest_dir="$final_path"
+fi
+
+chmod 750 "$final_path"
+chmod -R o-rwx "$final_path"
+chown -R $app:www-data "$final_path"
 
 #=================================================
 # NGINX CONFIGURATION
 #=================================================
 ynh_script_progression --message="Upgrading NGINX web server configuration..."
 
-# Create a dedicated nginx config
+# Create a dedicated NGINX config
 ynh_add_nginx_config
 
-#=================================================
-# CREATE DEDICATED USER
-#=================================================
-ynh_script_progression --message="Making sure dedicated system user exists..."
-
-# Create a dedicated user (if not existing)
-ynh_system_user_create --username=$app
-
 #=================================================
 # PHP-FPM CONFIGURATION
 #=================================================
 ynh_script_progression --message="Upgrading PHP-FPM configuration..."
 
-# Create a dedicated php-fpm config
+# Create a dedicated PHP-FPM config
 ynh_add_fpm_config --package="$extra_php_dependencies"
 
 #=================================================
@@ -141,20 +162,23 @@ ynh_add_fpm_config --package="$extra_php_dependencies"
 #=================================================
 # SETUP APPLICATION WITH CURL
 #=================================================
+ynh_script_progression --message="Setuping application with CURL..."
 
 # Set right permissions for curl install
 mkdir -p $final_path/plugins/auto
-chown -R $app: $final_path
+chown -R $app:www-data "$final_path"
 
 # Set the app as temporarily public for curl call
-ynh_app_setting_set --app=$app --key=skipped_uris --value="/"
+ynh_script_progression --message="Configuring SSOwat..."
-# Reload SSOwat config
+# Making the app public for curl
-yunohost app ssowatconf
+ynh_permission_update --permission="main" --add="visitors"
 
 ynh_backup_if_checksum_is_different --file="$final_path/config/connect.php"
 
 ynh_secure_remove --file="$final_path/config/connect.php"
 
+# Installation with curl
+ynh_script_progression --message="Finalizing installation..."
 ynh_local_curl "/ecrire/?suivant" "exec=install" "etape=chmod"
 ynh_local_curl "/ecrire/?suivant" "exec=install" "etape=2" "chmod=755" "adresse_db=localhost" "login_db=$db_name" "pass_db=$db_pwd" "server_db=mysql"
 ynh_local_curl "/ecrire/?suivant" "exec=install" "etape=3" "adresse_db=localhost" "login_db=$db_name" "pass_db=$db_pwd" "server_db=mysql" "choix_db=$db_name" "tprefix=$db_name"
@@ -182,10 +206,11 @@ email=$(yunohost user info $admin | grep mail: | cut -d' ' -f2 | tr -d '\n')
 ynh_local_curl "/ecrire/?suivant" "exec=install" "etape=3b" "adresse_db=localhost" "login_db=$db_name" "pass_db=$db_pwd" "server_db=mysql" "sel_db=$db_name" "nom=$admin" "email=$email" "login=$admin" "pass=$password" "pass_verif=$password"
 ynh_local_curl "/ecrire/?suivant" "exec=install" "etape=fin"
 
-ynh_app_setting_delete --app=$app --key=skipped_uris
+# Remove the public access
+ynh_permission_update --permission="main" --remove="visitors"
 
 #=================================================
-# MODIFY A CONFIG FILE
+# UPDATE A CONFIG FILE
 #=================================================
 
 #ynh_replace_string --match_string="'','utf8');" --replace_string="'ldap.php','utf8');" --target_file=$final_path/config/connect.php
@@ -202,13 +227,14 @@ ynh_store_file_checksum --file="$final_path/config/connect.php"
 #=================================================
 # SETUP SSOWAT
 #=================================================
-ynh_script_progression --message="Upgrading SSOwat configuration..."
+ynh_script_progression --message="Configuring permissions..."
 
 # Make app public if necessary
 if [ $is_public -eq 1 ]
 then
-	# unprotected_uris allows SSO credentials to be passed anyway
+	# Everyone can access the app.
-	ynh_app_setting_set --app=$app --key=unprotected_uris --value="/"
+	# The "main" permission is automatically created before the install script.
+	ynh_permission_update --permission="main" --add="visitors"
 fi
 
 #=================================================