Update Changelog

This commit is dedicated to Liandri, who is supporting me with great bzh food.
Many thanks :-)

.gitlab-ci.yml

@@ -29,6 +29,7 @@ sqlite2:
   script:
     - make podcheck
     - MOJO_CONFIG=t/sqlite2.conf make minion &
+    - sleep 3
     - MOJO_CONFIG=t/sqlite2.conf make test-sqlite
     - MOJO_CONFIG=t/sqlite2.conf make watch
     - MOJO_CONFIG=t/sqlite2.conf make cleanbdd

AUTHORS.md

@@ -2,7 +2,7 @@
 
 ## Main developers
 
-* Luc Didry, aka Sky (<http://www.fiat-tux.fr>), core developer, @framasky on [Twitter](https://twitter.com/framasky) and on [Diaspora*](https://framasphere.org/public/framasky)
+* Luc Didry, aka Sky (<http://www.fiat-tux.fr>), core developer, @framasky on [Mastodon](https://framapiaf.org/@framasky) and on [Diaspora*](https://framasphere.org/public/framasky)
 * Dattaz (<http://dattaz.fr>), webapp developer, [@dat_taz](https://twitter.com/dat_taz)
 
 ## Contributors

CHANGELOG

@@ -1,5 +1,29 @@
 Revision history for Lutim
 
+0.8.8  2018-02-07
+	- Fix security issues, thanks to SecuNinja
+
+0.8.7  2017-12-22
+	- Fix bug if dbtype not configured in lutim.conf
+
+0.8.6  2017-11-18
+	- Fix bug resulting in no EXIF tags deletion
+
+0.8.5  2017-07-09
+	- Fix Henny Penny font path in css
+
+0.8.4  2017-06-24
+	- Mitigate a bug using the same empty record twice
+
+0.8.3  2017-06-15
+	- Fix the donuts charts in the /stats page.
+
+0.8.2  2017-06-14
+	- Enforce Mojolicious::Plugin::AssetPack version
+
+0.8.1  2017-06-13
+	- Fix #46
+
 0.8  2017-06-13
 	- Improve statistics page
 	- Add database abstraction layer (#42)

cpanfile

@@ -1,11 +1,12 @@
 requires 'Mojolicious', '>= 7.31';
 requires 'EV';
 requires 'IO::Socket::SSL';
+requires 'Net::SSLeay', '>= 1.81';
 requires 'Data::Validate::URI';
 requires 'Net::Domain::TLD', '>= 1.73'; # Must have the last version to handle (at least) .xyz and .link
 requires 'Mojo::Pg';
 requires 'Mojolicious::Plugin::I18N';
-requires 'Mojolicious::Plugin::AssetPack';
+requires 'Mojolicious::Plugin::AssetPack', '>= 1.44';
 requires 'Mojolicious::Plugin::DebugDumperHelper';
 requires 'Mojolicious::Plugin::PgURLHelper';
 requires "Minion", "== 4.06";

cpanfile.snapshot

@@ -44,32 +44,6 @@ DISTRIBUTIONS
       perl 5.008001
       strict 0
       warnings 0
-  CPAN-Meta-2.150010
-    pathname: D/DA/DAGOLDEN/CPAN-Meta-2.150010.tar.gz
-    provides:
-      CPAN::Meta 2.150010
-      CPAN::Meta::Converter 2.150010
-      CPAN::Meta::Feature 2.150010
-      CPAN::Meta::History 2.150010
-      CPAN::Meta::Merge 2.150010
-      CPAN::Meta::Prereqs 2.150010
-      CPAN::Meta::Spec 2.150010
-      CPAN::Meta::Validator 2.150010
-      Parse::CPAN::Meta 2.150010
-    requirements:
-      CPAN::Meta::Requirements 2.121
-      CPAN::Meta::YAML 0.011
-      Carp 0
-      Encode 0
-      Exporter 0
-      ExtUtils::MakeMaker 6.17
-      File::Spec 0.80
-      JSON::PP 2.27300
-      Scalar::Util 0
-      perl 5.008001
-      strict 0
-      version 0.88
-      warnings 0
   CSS-Minifier-XS-0.09
     pathname: G/GT/GTERMARS/CSS-Minifier-XS-0.09.tar.gz
     provides:
@@ -1037,14 +1011,6 @@ DISTRIBUTIONS
       Clone 0
       ExtUtils::MakeMaker 0
       perl 5.008001
-  IO-Socket-IP-0.39
-    pathname: P/PE/PEVANS/IO-Socket-IP-0.39.tar.gz
-    provides:
-      IO::Socket::IP 0.39
-    requirements:
-      IO::Socket 0
-      Socket 1.97
-      Test::More 0.88
   IO-Socket-SSL-2.048
     pathname: S/SU/SULLR/IO-Socket-SSL-2.048.tar.gz
     provides:
@@ -1059,6 +1025,7 @@ DISTRIBUTIONS
       IO::Socket::SSL::Utils 2.014
     requirements:
       ExtUtils::MakeMaker 0
+      Mozilla::CA 0
       Net::SSLeay 1.46
       Scalar::Util 0
   IO-stringy-2.111
@@ -1264,16 +1231,6 @@ DISTRIBUTIONS
     requirements:
       ExtUtils::MakeMaker 0
       perl 5.004
-  JSON-PP-2.94
-    pathname: I/IS/ISHIGAKI/JSON-PP-2.94.tar.gz
-    provides:
-      JSON::PP 2.94
-      JSON::PP::Boolean 2.94
-      JSON::PP::IncrParser 2.94
-    requirements:
-      ExtUtils::MakeMaker 0
-      Scalar::Util 1.08
-      Test::More 0
   JavaScript-Minifier-XS-0.11
     pathname: G/GT/GTERMARS/JavaScript-Minifier-XS-0.11.tar.gz
     provides:
@@ -1340,6 +1297,7 @@ DISTRIBUTIONS
     requirements:
       ExtUtils::MakeMaker 0
       Mojolicious 6.0
+      perl 5.010001
   Minion-Backend-SQLite-0.009
     pathname: D/DB/DBOOK/Minion-Backend-SQLite-0.009.tar.gz
     provides:
@@ -1462,6 +1420,7 @@ DISTRIBUTIONS
       ExtUtils::MakeMaker 0
       Mojolicious 7.32
       SQL::Abstract 1.81
+      perl 5.010001
   Mojo-SQLite-2.002
     pathname: D/DB/DBOOK/Mojo-SQLite-2.002.tar.gz
     provides:
@@ -1605,6 +1564,7 @@ DISTRIBUTIONS
       JSON::PP 2.27103
       Pod::Simple 3.09
       Time::Local 1.2
+      perl 5.010001
   Mojolicious-Plugin-AssetPack-1.44
     pathname: J/JH/JHTHORSEN/Mojolicious-Plugin-AssetPack-1.44.tar.gz
     provides:
@@ -1689,6 +1649,14 @@ DISTRIBUTIONS
       Sub::Defer 2.003001
       Sub::Quote 2.003001
       perl 5.006
+  Mozilla-CA-20160104
+    pathname: A/AB/ABH/Mozilla-CA-20160104.tar.gz
+    provides:
+      Mozilla::CA 20160104
+    requirements:
+      ExtUtils::MakeMaker 0
+      Test 0
+      perl 5.006
   Net-Domain-TLD-1.75
     pathname: A/AL/ALEXP/Net-Domain-TLD-1.75.tar.gz
     provides:

lib/Lutim.pm

@@ -43,7 +43,8 @@ sub startup {
             theme             => 'default',
             dbtype            => 'sqlite',
             max_files_in_zip  => 15,
-            minion           => {
+            prefix            => '/',
+            minion            => {
                 enabled => 0,
                 dbtype  => 'sqlite',
                 db_path => 'minion.db'

lib/Lutim/Command/cron/stats.pm

@@ -152,7 +152,7 @@ sub run {
 %     l('Total')
 % );
 <script>
-Morris.Donut({
+var enabled_donut = {
   element: 'raw-enabled-holder',
   data: [
     {label: "<%= l('no time limit') %>", value: $unlimited_enabled},
@@ -168,8 +168,8 @@ Morris.Donut({
       '#427dc1',
       '#455ac3',
   ]
-});
-Morris.Donut({
+};
+var disabled_donut = {
   element: 'raw-disabled-holder',
   data: [
     {label: "<%= l('no time limit') %>", value: $unlimited_disabled},
@@ -185,7 +185,7 @@ Morris.Donut({
       '#427dc1',
       '#455ac3',
   ]
-});
+};
 </script>
 $dom2
 EOF

lib/Lutim/Controller.pm

@@ -1,7 +1,7 @@
 # vim:set sw=4 ts=4 sts=4 expandtab:
 package Lutim::Controller;
 use Mojo::Base 'Mojolicious::Controller';
-use Mojo::Util qw(url_escape url_unescape b64_encode);
+use Mojo::Util qw(url_escape url_unescape b64_encode encode);
 use Mojo::Asset::Memory;
 use Mojo::JSON qw(true false);
 use Lutim::DB::Image;
@@ -384,24 +384,26 @@ sub add {
 
                 }
 
-                unless ((defined($keep_exif) && $keep_exif) || $mediatype eq 'image/svg+xml' || $mediatype !~ m#image/(x-)?xcf# || $mediatype ne 'image/webp') {
-                    # Remove the EXIF tags
-                    my $data = new IO::Scalar \$upload->slurp();
-                    my $et   = new Image::ExifTool;
+                unless (defined($keep_exif) && $keep_exif) {
+                    if ($mediatype ne 'image/svg+xml' && $mediatype !~ m#image/(x-)?xcf# && $mediatype ne 'image/webp') {
+                        # Remove the EXIF tags
+                        my $data = new IO::Scalar \$upload->slurp();
+                        my $et   = new Image::ExifTool;
 
-                    # Use $data in Image::ExifTool object
-                    $et->ExtractInfo($data);
-                    # Remove all metadata
-                    $et->SetNewValue('*', undef);
+                        # Use $data in Image::ExifTool object
+                        $et->ExtractInfo($data);
+                        # Remove all metadata
+                        $et->SetNewValue('*', undef);
 
-                    # Create a temporary IO::Scalar to write into
-                    my $temp;
-                    my $a = new IO::Scalar \$temp;
-                    $et->WriteInfo($data, $a);
+                        # Create a temporary IO::Scalar to write into
+                        my $temp;
+                        my $a = new IO::Scalar \$temp;
+                        $et->WriteInfo($data, $a);
 
-                    # Update the uploaded file with it's no-tags clone
-                    $data = Mojo::Asset::Memory->new->add_chunk($temp);
-                    $upload->asset($data);
+                        # Update the uploaded file with it's no-tags clone
+                        $data = Mojo::Asset::Memory->new->add_chunk($temp);
+                        $upload->asset($data);
+                    }
                 }
 
                 my $key;
@@ -532,7 +534,7 @@ sub short {
         }
 
         my $test;
-        if (defined($touit)) {
+        if (defined($touit) && $image->mediatype !~ m/svg/) {
             $test = 1;
             my $short  = $image->short;
                $short .= '/'.$key if (defined($key));
@@ -656,7 +658,7 @@ sub zip {
                     $c->delete_image($image);
 
                     # Warn user
-                    $zip->addString($c->l('Unable to find the image: it has been deleted.'), 'images/'.$filename.'.txt');
+                    $zip->addString(encode('UTF-8', $c->l('Unable to find the image: it has been deleted.')), 'images/'.$filename.'.txt');
                     next;
                 }
 
@@ -668,7 +670,7 @@ sub zip {
                     # Delete image
                     $c->delete_image($image);
 
-                    $zip->addString($c->l('Unable to find the image: it has been deleted.'), 'images/'.$filename.'.txt');
+                    $zip->addString(encode('UTF-8', $c->l('Unable to find the image: it has been deleted.')), 'images/'.$filename.'.txt');
                     next;
                 } else {
                     my $expires = ($image->delete_at_day) ? $image->delete_at_day : 360;
@@ -679,7 +681,7 @@ sub zip {
                     my $path = $image->path;
                     unless ( -f $path && -r $path ) {
                         $c->app->log->error("Cannot read file [$path]. error [$!]");
-                        $zip->addString($c->l('Unable to find the image: it has been deleted.'), 'images/'.$filename.'.txt');
+                        $zip->addString(encode('UTF-8', $c->l('Unable to find the image: it has been deleted.')), 'images/'.$filename.'.txt');
                         next;
                     }
 
@@ -704,10 +706,10 @@ sub zip {
                 $c->app->log->info('[NOT FOUND] someone tried to view '.$short.' but it does\'nt exist anymore.');
 
                 # Warn user
-                $zip->addString($c->l('Unable to find the image: it has been deleted.'), 'images/'.$image->filename.'.txt');
+                $zip->addString(encode('UTF-8', $c->l('Unable to find the image: it has been deleted.')), 'images/'.$image->filename.'.txt');
                 next;
             } else {
-                $zip->addString($c->l('Image not found.'), 'images/'.$short.'.txt');
+                $zip->addString(encode('UTF-8', $c->l('Image not found.')), 'images/'.$short.'.txt');
                 next;
             }
         }

lib/Lutim/DB/Image/Pg.pm

@@ -69,7 +69,8 @@ sub select_created_after {
 sub select_empty {
     my $c = shift;
 
-    my $record = $c->app->pg->db->query('SELECT * FROM lutim WHERE path IS NULL LIMIT 1')->hashes->first;
+    my $record = $c->app->pg->db->query('SELECT * FROM lutim WHERE path IS NULL')->hashes->shuffle->first;
+    $c->app->pg->db->query('UPDATE lutim SET path = ? WHERE short = ?', 'used', $record->{short});
 
     $c = $c->_slurp($record);
 

lib/Lutim/DB/Image/SQLite.pm

@@ -72,9 +72,10 @@ sub select_created_after {
 sub select_empty {
     my $c = shift;
 
-    my @records = Lutim::DB::SQLite::Lutim->select('WHERE path IS NULL LIMIT 1');
+    my $record = c(Lutim::DB::SQLite::Lutim->select('WHERE path IS NULL'))->shuffle->first;
+    $record->update(path => 'used');
 
-    $c->record($records[0]);
+    $c->record($record);
     $c = $c->_slurp;
 
     return $c;

lib/Lutim/Plugin/Helpers.pm

@@ -16,7 +16,7 @@ sub register {
 
         # Database migration
         my $migrations = Mojo::Pg::Migrations->new(pg => $app->pg);
-        if ($app->mode eq 'development') {
+        if ($app->mode eq 'development' && $ENV{LUTIM_DEBUG}) {
             $migrations->from_file('utilities/migrations.sql')->migrate(0)->migrate(1);
         } else {
             $migrations->from_file('utilities/migrations.sql')->migrate(1);

lib/Mounter.pm

@@ -22,8 +22,28 @@ sub startup {
         {
             file    => $cfile,
             default => {
-                prefix => '/',
-                theme  => 'default',
+                provisioning      => 100,
+                provis_step       => 5,
+                length            => 8,
+                always_encrypt    => 0,
+                anti_flood_delay  => 5,
+                tweet_card_via    => '@framasky',
+                max_file_size     => 10*1024*1024,
+                https             => 0,
+                default_delay     => 0,
+                max_delay         => 0,
+                token_length      => 24,
+                crypto_key_length => 8,
+                thumbnail_size    => 100,
+                theme             => 'default',
+                dbtype            => 'sqlite',
+                max_files_in_zip  => 15,
+                prefix            => '/',
+                minion            => {
+                    enabled => 0,
+                    dbtype  => 'sqlite',
+                    db_path => 'minion.db'
+                },
             }
         }
     );

themes/default/public/css/hennypenny.css

@@ -2,5 +2,5 @@
   font-family: 'Henny_Penny';
   font-style: normal;
   font-weight: 400;
-  src: local('Henny Penny'), local('HennyPenny-Regular'), url(../font/hennypenny.ttf) format('truetype');
+  src: local('Henny Penny'), local('HennyPenny-Regular'), url(../../font/hennypenny.ttf) format('truetype');
 }

themes/default/public/js/stats.js

@@ -64,4 +64,6 @@ $(document).ready(function() {
         $("#total-holder").empty();
         graph(stats_labels, stats_data, stats_total);
     });
+    Morris.Donut(enabled_donut);
+    Morris.Donut(disabled_donut);
 });

themes/default/templates/partial/lutim.js.ep

@@ -172,9 +172,9 @@ function buildMessage(success, msg) {
             '<div class="alert alert-danger">',
                 '<button type="button" class="close" data-dismiss="alert" aria-hidden="true">&times;</button>',
                 '<strong><%= l('Something bad happened') %></strong><br>',
-                msg.filename,
+                cleanName(msg.filename, false),
                 '<br>',
-                msg.msg,
+                cleanName(msg.msg, false),
             '</div>'
         ].join('');
     }