Update Changelog

This commit is dedicated to Liandri, who is supporting me with great bzh food.
Many thanks :-)

AUTHORS.md

@@ -2,7 +2,7 @@
 
 ## Main developers
 
-* Luc Didry, aka Sky (<http://www.fiat-tux.fr>), core developer, @framasky on [Twitter](https://twitter.com/framasky) and on [Diaspora*](https://framasphere.org/public/framasky)
+* Luc Didry, aka Sky (<http://www.fiat-tux.fr>), core developer, @framasky on [Mastodon](https://framapiaf.org/@framasky) and on [Diaspora*](https://framasphere.org/public/framasky)
 * Dattaz (<http://dattaz.fr>), webapp developer, [@dat_taz](https://twitter.com/dat_taz)
 
 ## Contributors

CHANGELOG

@@ -1,5 +1,17 @@
 Revision history for Lutim
 
+0.8.8  2018-02-07
+	- Fix security issues, thanks to SecuNinja
+
+0.8.7  2017-12-22
+	- Fix bug if dbtype not configured in lutim.conf
+
+0.8.6  2017-11-18
+	- Fix bug resulting in no EXIF tags deletion
+
+0.8.5  2017-07-09
+	- Fix Henny Penny font path in css
+
 0.8.4  2017-06-24
 	- Mitigate a bug using the same empty record twice
 

lib/Lutim.pm

@@ -43,7 +43,8 @@ sub startup {
             theme             => 'default',
             dbtype            => 'sqlite',
             max_files_in_zip  => 15,
-            minion           => {
+            prefix            => '/',
+            minion            => {
                 enabled => 0,
                 dbtype  => 'sqlite',
                 db_path => 'minion.db'

lib/Lutim/Controller.pm

@@ -384,24 +384,26 @@ sub add {
 
                 }
 
-                unless ((defined($keep_exif) && $keep_exif) || $mediatype eq 'image/svg+xml' || $mediatype !~ m#image/(x-)?xcf# || $mediatype ne 'image/webp') {
-                    # Remove the EXIF tags
-                    my $data = new IO::Scalar \$upload->slurp();
-                    my $et   = new Image::ExifTool;
+                unless (defined($keep_exif) && $keep_exif) {
+                    if ($mediatype ne 'image/svg+xml' && $mediatype !~ m#image/(x-)?xcf# && $mediatype ne 'image/webp') {
+                        # Remove the EXIF tags
+                        my $data = new IO::Scalar \$upload->slurp();
+                        my $et   = new Image::ExifTool;
 
-                    # Use $data in Image::ExifTool object
-                    $et->ExtractInfo($data);
-                    # Remove all metadata
-                    $et->SetNewValue('*', undef);
+                        # Use $data in Image::ExifTool object
+                        $et->ExtractInfo($data);
+                        # Remove all metadata
+                        $et->SetNewValue('*', undef);
 
-                    # Create a temporary IO::Scalar to write into
-                    my $temp;
-                    my $a = new IO::Scalar \$temp;
-                    $et->WriteInfo($data, $a);
+                        # Create a temporary IO::Scalar to write into
+                        my $temp;
+                        my $a = new IO::Scalar \$temp;
+                        $et->WriteInfo($data, $a);
 
-                    # Update the uploaded file with it's no-tags clone
-                    $data = Mojo::Asset::Memory->new->add_chunk($temp);
-                    $upload->asset($data);
+                        # Update the uploaded file with it's no-tags clone
+                        $data = Mojo::Asset::Memory->new->add_chunk($temp);
+                        $upload->asset($data);
+                    }
                 }
 
                 my $key;
@@ -532,7 +534,7 @@ sub short {
         }
 
         my $test;
-        if (defined($touit)) {
+        if (defined($touit) && $image->mediatype !~ m/svg/) {
             $test = 1;
             my $short  = $image->short;
                $short .= '/'.$key if (defined($key));

lib/Mounter.pm

@@ -22,8 +22,28 @@ sub startup {
         {
             file    => $cfile,
             default => {
-                prefix => '/',
-                theme  => 'default',
+                provisioning      => 100,
+                provis_step       => 5,
+                length            => 8,
+                always_encrypt    => 0,
+                anti_flood_delay  => 5,
+                tweet_card_via    => '@framasky',
+                max_file_size     => 10*1024*1024,
+                https             => 0,
+                default_delay     => 0,
+                max_delay         => 0,
+                token_length      => 24,
+                crypto_key_length => 8,
+                thumbnail_size    => 100,
+                theme             => 'default',
+                dbtype            => 'sqlite',
+                max_files_in_zip  => 15,
+                prefix            => '/',
+                minion            => {
+                    enabled => 0,
+                    dbtype  => 'sqlite',
+                    db_path => 'minion.db'
+                },
             }
         }
     );

themes/default/public/css/hennypenny.css

@@ -2,5 +2,5 @@
   font-family: 'Henny_Penny';
   font-style: normal;
   font-weight: 400;
-  src: local('Henny Penny'), local('HennyPenny-Regular'), url(../font/hennypenny.ttf) format('truetype');
+  src: local('Henny Penny'), local('HennyPenny-Regular'), url(../../font/hennypenny.ttf) format('truetype');
 }

themes/default/templates/partial/lutim.js.ep

@@ -172,9 +172,9 @@ function buildMessage(success, msg) {
             '<div class="alert alert-danger">',
                 '<button type="button" class="close" data-dismiss="alert" aria-hidden="true">&times;</button>',
                 '<strong><%= l('Something bad happened') %></strong><br>',
-                msg.filename,
+                cleanName(msg.filename, false),
                 '<br>',
-                msg.msg,
+                cleanName(msg.msg, false),
             '</div>'
         ].join('');
     }