Update Changelog

This commit is dedicated to Liandri, who is supporting me with great bzh food.
Many thanks :-)

AUTHORS.md

@@ -2,7 +2,7 @@
 
 ## Main developers
 
-* Luc Didry, aka Sky (<http://www.fiat-tux.fr>), core developer, @framasky on [Twitter](https://twitter.com/framasky) and on [Diaspora*](https://framasphere.org/public/framasky)
+* Luc Didry, aka Sky (<http://www.fiat-tux.fr>), core developer, @framasky on [Mastodon](https://framapiaf.org/@framasky) and on [Diaspora*](https://framasphere.org/public/framasky)
 * Dattaz (<http://dattaz.fr>), webapp developer, [@dat_taz](https://twitter.com/dat_taz)
 
 ## Contributors

CHANGELOG

@@ -1,5 +1,11 @@
 Revision history for Lutim
 
+0.8.8  2018-02-07
+	- Fix security issues, thanks to SecuNinja
+
+0.8.7  2017-12-22
+	- Fix bug if dbtype not configured in lutim.conf
+
 0.8.6  2017-11-18
 	- Fix bug resulting in no EXIF tags deletion
 

lib/Lutim.pm

@@ -43,7 +43,8 @@ sub startup {
             theme             => 'default',
             dbtype            => 'sqlite',
             max_files_in_zip  => 15,
-            minion           => {
+            prefix            => '/',
+            minion            => {
                 enabled => 0,
                 dbtype  => 'sqlite',
                 db_path => 'minion.db'

lib/Lutim/Controller.pm

@@ -534,7 +534,7 @@ sub short {
         }
 
         my $test;
-        if (defined($touit)) {
+        if (defined($touit) && $image->mediatype !~ m/svg/) {
             $test = 1;
             my $short  = $image->short;
                $short .= '/'.$key if (defined($key));

lib/Mounter.pm

@@ -22,8 +22,28 @@ sub startup {
         {
             file    => $cfile,
             default => {
-                prefix => '/',
-                theme  => 'default',
+                provisioning      => 100,
+                provis_step       => 5,
+                length            => 8,
+                always_encrypt    => 0,
+                anti_flood_delay  => 5,
+                tweet_card_via    => '@framasky',
+                max_file_size     => 10*1024*1024,
+                https             => 0,
+                default_delay     => 0,
+                max_delay         => 0,
+                token_length      => 24,
+                crypto_key_length => 8,
+                thumbnail_size    => 100,
+                theme             => 'default',
+                dbtype            => 'sqlite',
+                max_files_in_zip  => 15,
+                prefix            => '/',
+                minion            => {
+                    enabled => 0,
+                    dbtype  => 'sqlite',
+                    db_path => 'minion.db'
+                },
             }
         }
     );

themes/default/templates/partial/lutim.js.ep

@@ -172,9 +172,9 @@ function buildMessage(success, msg) {
             '<div class="alert alert-danger">',
                 '<button type="button" class="close" data-dismiss="alert" aria-hidden="true">&times;</button>',
                 '<strong><%= l('Something bad happened') %></strong><br>',
-                msg.filename,
+                cleanName(msg.filename, false),
                 '<br>',
-                msg.msg,
+                cleanName(msg.msg, false),
             '</div>'
         ].join('');
     }