Tests:
- Config app description is as expected.
- Config form does not show hostname anymore.
- Submitting the form with changes works.
- Names app has correct link for configuring Local Domain Name. Clicking it
takes to page for setting hostname.
- Avahi shows the current .local domain correctly in Names app.
- Change hostname form shows correct value for current hostname.
- Change hostname form sets the value for hostname properly.
- Page title is correct.
- Validations works.
- Pre/post hostname change signals are sent properly
- Success message as shown expected
- hostnamectl shows the set domain
- If domain name is not set, downloaded OpenVPN profile shows hostname.
- Unit tests work.
- Functional tests on names/config/avahi apps work.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
Closes#2092
On testing and unstable systems, /etc/os-release does not contain
VERSION_ID. In this case, lsb_release will report the release as
"n/a".
For unstable, this means that backports can be enabled in development
mode. When this happens, trixie-backports will be added as an apt
repository. The repository already exists, so it does not cause any
problem.
Tests:
- In stable container, backports can be enabled.
- In stable container, dist-upgrade can be disable and enabled.
- In stable container, in development mode, dist-upgrade can be
started.
- In testing container, backports cannot be enabled.
- In testing container, dist-upgrade cannot be enabled or started.
- In testing container, in development mode, backports can be enabled.
- In testing container, in development mode, dist-upgrade cannot be
started.
- In unstable container, in development mode, backports can be enabled
(as trixie-backports).
- In unstable container, in development mode, dist-upgrade cannot be
started.
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
[sunil: Merge the case of outdated unstable distributions that return 'unstable'
as release and newer unstable distributions that return 'n/a']
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
Closes: #707
Helps: #1570
- Network Manager's 'shared' connections use port 53 on those interfaces. Bind
by default also listens on them if possible. In some corner cases, this could
lead to a clash. This patch fixes to cases by making sure bind does not listen
on IP address likely used by Network Manager's 'shared' connections. If user
custom configures address, they will need to update the bind configuration
accordingly.
- App version increment is not necessary because in this release cycle we have
already incremented it once.
Tests:
- Install without patch. Increment the app version number (and the version
number in the privileged script). Notice that bind app setup is run again.
'listen-on' line is inserted into the configuration file as expected.
- Increment the version numbers again and a second 'listen-on' line is not
inserted.
- Without patch, on a machine with two network interfaces, start a 'shared'
network connection. Start bind. Notice the error that bind could not listen on
the shared network IP address.
- Without patch, on a machine with two network interface, start bind while
'shared' network connection is configured with just the IP address. Start bind
and it will listening on the IP address with shared network IP address.
Configure a shared connection and it fails to start.
- Apply the patch. Start 'shared' network connection. Start bind and notice that
bind does not attempt to listen on that shared network IP address and does not
print error message as well.
- Apply the patch. Start bind while 'shared' network connection is configured
with just the IP address. Bind does not attempt to listen on that shared network
IP address. Start the shared network connection. It start without issues.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- In create/edit network connection form, if the accordion is closed for
'General' section, Network Interface has not be selected yet and Submit button
is pressed, 'General' section should be expanded and focus should go to Network
Interface field. This is not working as expected as the code to expand
accordions didn't match 'select' type input fields properly. Fix this.
- Declare a common class name for both create and edit forms to make writing
queries easier.
- Drop console logs that where meant for debugging.
Tests:
- On both create and edit connection forms, set the value of network interface
to '--select--' and collapse the 'General' section. Press submit. The 'General'
section is expanded, Network Interface field is focus and scrolled into view.
- Do the same check for another field such as Connection Name and that works
too.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
This improves the user experience in many ways:
- Help user understand if DNSSEC is being used on the current DNS server in case
'allow-fallback' is supported.
- Nudges the user to explore enabling DNS-over-TLS and DNSSEC.
- Help user understand how global vs. link specific configuration works. Help
user understand if a global DNS is being used.
- Show the list of fallback DNS servers being used (as this poses privacy
concerns).
Also helps with debugging in problematic situations:
- Find out which DNS server is being used (and leading to problems) and show the
cycling mechanism.
Tests:
- Enable/disable fallback DNS server in privacy app. See that fallback servers
line is only shown when enabled.
- Set various global values of DNS-over-TLS and DNSSEC and see the status
changes.
- Set various values of DNS-over-TLS in the network connection settings and see
the changes in status.
- Set DNSSEC to allow-fallback. Perform a query and see that the value of
supported/unsupported changes.
- Set DNS servers with special configuration file in
/etc/systemd/resolved.conf.d/test.conf and restart systemd-resolved. See change
in status page. Notice that if connection specific DNS server is set to an
invalid server, global section has a current DNS server.
- Set SNI domain name and port for the an IPv4 DNS and an IPv6 DNS. See that the
display is as expected.
- Raise an exception in get_status() and notice that an error alert is show
properly.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewd-by: Veiko Aasa <veiko17@disroot.org>
Pass remaining failed checks to super.
Tests:
- Remove /etc/letsencrypt/renewal-hooks/deploy/50-freedombox so that
the diagnostic fails. Running repair causes the file to be
re-created.
- Set domain name to non-existing domain so that the diagnostic
fails. Running repair attempts to obtain the certificate.
- Have both diagnostics failing. Running repair will attempt to repair
both.
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
So that when users select 'Default' they understand what value applies and how
to change it.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
- Reloading systemd-resolved does not seem to apply the DNS-over-TLS changes
fully. Although resolvectl shows the new status after a reload, systemd-resolved
seems to be using incorrect DNS-over-TLS setting.
Tests:
- Without the patch, set DNS server that does not support DNS-over-TLS such as
dnsmasq in Network Manager's 'shared' connection. Then enable DNS-over-TLS.
resolvectl shows that DNSOverTLS flag correctly. But name resolutions still
work.
- With the patch, repeat the above and notice that resolution does not work.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
- Use deb.debian.org because it is already contacted regularly for
checking/downloading packages and updates.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
Tests:
- Visit the names app. New 'Domains' heading and configuration section appear.
- DNS-over-TLS configuration option is as expected.
- When the configuration file does not exist, the option selected is 'no'.
- When the configuration option is changed, 'resolvectl' shows the newly set
configuration. Using 'resolvectl query {domain}' does not work when DoT is on
and server does not support DoT. 'opportunistic' and 'no' work on those cases.
- When a DNS server supporting DoT (such as 1.1.1.1) is manually set, resolution
with all three settings works.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
- Without selecting an option, trying to submit the form leads to an error.
Tests:
- Go to the new connection form, notice that the 'auto' method is selected by
default.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
- If an existing network manager connection with the missing values is ever
edited, it leads an awkward interface.
- So, complete the setting by allowing values supported by Network Manager.
Tests:
- Create new connections with the new values 'link-local' and 'disabled'.
Connection creation succeeds.
- Editing connection to these values works too.
- When 'link-local' or 'disabled' values are selected, primary and secondary DNS
fields are disabled.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
- Expose Network Manager per-connection setting for DNS-over-TLS. Support all
four values: default, no, opportunistic, and yes.
- Create a new collapsible section all 'Privacy' for this setting the connection
create/edit form. Strictly speaking this is related to security and censorship
resistance too.
- Don't show the DoT field for PPPoE connection types are DNS servers are not
relevant.
- Show the status of DoT for a connection in the connection status page.
Tests:
- In all Add New Connection forms except PPPoE form, the privacy
section shows up as expected.
- For each value for DoT, create a new connection and set the value for DoT to the
desired value and observe that the connection status page shows DoT to the set
value.
- For each value for DoT, edit an existing connection and set the value for the
DoT to the desired value and observe that the connection status page shows DoT
to the set value.
- Connection status page shows the values for DoT as expected.
- Update the primary Internet connection for the machine. Set the value to 'yes'
and notice that DNS resolutions fail. Set the value to 'opportunistic' or 'no'
and the DNS resolutions pass. In each case, 'resolvectl' shows the correct DoT
value for the connection. When 1.1.1.1 is set as DNS server, all values of DoT
in the connection succeed.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
Package holds are only expected when apps are being installed or
uninstalled, or during distribution upgrade process. At any other
time, package holds are not expected and should be released.
Tests:
- Place a hold on one package. Run the upgrades diagnostics, which
will have a failure. Try to repair the failure, and confirm that the
package is no longer held.
- Repeat with two or three packages being held.
[sunil]
- When the package 'needsrestart' is outdated and another package is held,
running repair unholds the package as well as runs setup() on the upgrades app
leading to 'needsrestart' package getting upgrade.
- When only failed diagnostic is for package holds. Running repair unholds the
packages but does not rung setup().
Helps: #2347
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
Fixes: #2432
Tests:
- Without patch install MediaWiki. phpinfo() shows max execution time for 30
seconds. Apply patch, run 'make install' and restart service. Mediawiki app is
updated. Apache2 is reloaded. phpinfo() shows max execution time for 100
seconds.
- Create a script to 100% utilize the CPU for 90 seconds. It works.
- Create a script to 100% utilize the CPU for 110 seconds. It fails and get
killed after about 100 seconds.
Signed-off-by: Joseph Nuthalapati <njoseph@riseup.net>
Tested-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
Closes: #1196.
- systemd-resolved always contains the current list of known DNS servers taken
from systemd-networkd, network-manager, or by other means. It also has fallback
DNS servers. Forwarding requests to it allows correct and failsafe way to reach
external DNS servers.
Tests:
- Freshly install bind and notice that the fowarders list is set to 127.0.0.53.
- Install without the patch. Apply patch. Restart service. bind is upgraded to
new version and forwarder is set to 127.0.0.53 if it is blank. Otherwise, it
remains as is.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
Tests:
- Without patch, disable bind. Incrementing the app's version number results in
bind getting started.
- With patch, disable bind. Incrementing the app's version number does not
result in bind getting started.
- Without patch, disable bind. Update forwarders. Bind is running again.
- With patch, disable bind. Update forwarders. Bind is not running again.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
- Before this change, when bind is disabled, dns port is removed from firewall
causing all 'shared' connection to not be able to resolve domains. This was
because no other application was declaring a need for 'dns' port to be kept
open. Declare a firewall component in the networks app needing 'dns' and 'dhcp'
services on the internal networks.
Tests:
- Without the patch, install and disable bind. 'dns' port is removed from
'internal' zone of the firewall.
- Install and disable bind. 'dns' port is not removed from 'internal' zone of
the firewall.
- On a fresh Debian machine. Install the freedombox package. 'http', 'https',
'dns' and 'dhcp' port are opened on the firewall as expected.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
Tests:
- Without the patch, start the service and dismiss the privacy notification.
With the patch, the restart the service. Privacy app is updated and privacy
notification is shown again. Incrementing the version number of the privacy app
does not result in showing of the notification again.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
- Using public DNS servers leads to user's domain queries being known to the
servers, violating privacy. However, it is necessary to address many corner
cases when DNS servers are not known to systemd-resolved but internet
connectivity is working. Allow users to disable fallback DNS servers.
Tests:
- After upgrade to latest version of FreedomBox, the setting is on by default.
- Disabling removes the /etc configuration file and resolvectl shows no fallback
DNS entries.
- Enabling add the /etc configuration file and resolvectl shows fallback
entries. After removing existing DNS servers using resolvectl, one can still
query using fallback servers.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
- This avoids using fallback DNS servers in systemd-resolved soon after
systemd-resolved takes over /etc/resolv.conf and if network-manager knows some
DNS servers from the connections it has established.
- Version for the names app has already been incremented in this patch series.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
- Disable mDNS resolution. While we can migrate our DNS-SD service definition
files to systemd-resolved and switch from using avahi to systemd-resolved, many
programs still solely depend on avahi-daemon. Examples include cups and GNOME.
It is not clear if they will work any mDNS daemon or if they interact with
avahi-daemon in other ways that the mDNS protocol. So, for now, disable mDNS in
systemd-resolved and continue to use avahi-daemon for it. This is also Fedora's
default.
- Re-introduce Fallback DNS servers with the value same as the upstream systemd
project. Debian removes the default fallback DNS servers likely because they
could be considered a privacy violation. However, when systemd-resolved package
is first installed, the post install script recommends a reboot instead of
feeding the currently configured nameservers from /etc/resolve.conf into
systemd-resolved. Immediately, this causes the system not be able to connect to
any external servers. While this may be acceptable solution for interactive
systems and pre-built images, FreedomBox has to a) be available for remote
access b) perform upgrades without user intervention (and without reboot until a
day). To mitigate privacy concerns, an option to disable these fallback servers
will be provided in the UI.
- systemd-resolved's stub resolver runs on 127.0.0.53%lo:53 and 127.0.0.54. This
does not conflict either with shared connections which listen on 10.42.x.1 or
with bind which listens on 127.0.0.1 (and other IP addresses). This MR does not
address the existing conflict between bind and shared network connections.
However, it does not cause any further conflicts.
Tests:
* mDNS
- Avahi diagnostics works. daemon is running. mdns port is exposed in the
firewall.
- systemd-resolved does not listen on mDNS ports.
- Running avahi-browse shows freedombox on local network.
- Running avahi-browse shows the services ssh, sftp-ssh, http and ejabberd.
- Machine can be discovered in Gnome Files.
* NetworkManager shared connections
- After install/upgrade to systemd-resolved, 'shared' connections can be
created.
- With a 'shared' connection configured and active, it is possible to upgrade to
using systemd-resolved.
- Resolving domains from a machine on shared network goes via systemd-resolved
on FreedomBox.
* Bind
- Installing, running tests on bind works.
- Programs connecting from outside network can connect to bind as expected.
- Programs connecting from local machine can connect to bind as expected.
* Upgrading works
- Upgrading to new FreedomBox package works
- systemd-resolved is installed and running. 'resolvectl' shows a proper name
server (or fallback nameserver like 1.1.1.1).
- libnss-resolve is installed and configured in /etc/nsswitch.conf
- /etc/resolv.conf has proper link to /run/systemd/resolve/stub-resolv.conf.
- Programs using /etc/resolv.conf directly work. Install python3-pycares.
python3 -m pycares freedombox.org.
- NetworkManager has passed on proper DNS entries. In logs dns=systemd-resolved,
rc-manager=unmanaged, plugin=systemd-resolved
- DNS resolution works after first setup. Installing packages works.
- 'resolvectl query' resolution works.
- Programs using glibc API resolution such as 'ping' work.
* Fresh image
- Building an image with new freedombox package works without error.
- Booting from fresh images works.
- systemd-resolved is installed and running. 'resolvectl' show proper name
server.
- libnss-resolve is installed and configured in /etc/nsswitch.conf
- /etc/resolv.conf has proper link to /run/systemd/resolve/stub-resolv.conf
- Programs using /etc/resolv.conf directly work. Install python3-pycares.
python3 -m pycares wikipedia.org
- NetworkManager has passed on proper DNS entries. In logs dns=systemd-resolved,
rc-manager=unmanaged, plugin=systemd-resolved
- DNS resolution works after first setup. Installing packages works.
* Installing package on Debian
- Installing new freedombox package in Debian machine works.
- systemd-resolved is installed and running.
- libnss-resolve is installed and configured.
- /etc/resolv.conf has proper link to /run
- NetworkManager has passed on proper DNS entries to systemd-resolved using
'nmcli reload dns-rc'.
- Resolution works with fallback DNS servers when network interfaces are
configured with /etc/network/interfaces
* OpenVPNs works
- As a server, we don't push DNS servers to the client. So, a client continues
to use its old DNS servers. With systemd-resolved running on server, the client
is able to connect to OpenVPN server, route traffic to the internet, and resolve
DNS queries.
* WireGuard works
- As a server, we can't push DNS servers to the client. So, a client continues
to use its old DNS servers. With systemd-resolved running on server, the client
is able to connect to WireGuard server, route traffic to the internet, and
resolve DNS queries.
- As a client, server does not push DNS servers to the client. So, a client
continues to use its old DNS servers. With systemd-resolved running on the
client, the client is able to connect to WireGuard server, route traffic to the
internet, and resolve DNS queries.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
On systems where the grub-pc package is not available (e.g. ARM),
dpkg-query will have an exit status of 1. Handle the error that is
raised in this case.
Tests:
- Added unit tests for storage._diagnose_grub_configured.
- Tested on Raspberry Pi 4.
Closes: #2441
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
- Add a new diagnostic check result for skipped tests.
Tests:
- Put a hold on a package. The diagnostic is failed.
- Remove the hold from the package. The diagnostic is passed.
- Start installing an app, then immediately run the upgrades
diagnostics. The diagnostic is skipped.
Helps: #2347
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
[sunil: Allow i18n for new state 'skipped']
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
- Create new policy that allows forwarding between zones.
See: https://bugzilla.redhat.com/show_bug.cgi?id=2016864#c8
- Increment version to perform setup on upgrade.
Closes: #2355
Tests:
- Build freedombox package, and install on top of Bookworm VM The
firewall setup is performed. firewall-cmd lists the fbx_int_to_ext_fwd
policy, masquerade on external zone, and forward on internal zone.
Not tested:
- I did not test forwarding traffic from external to internal zone.
However, several users have reported following these instructions on
the forum, and that it solved the issue for them.
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
[sunil: Minor refactors for readability]
[sunil: Ensure that operation is idempotent]
[sunil: Reload instead of restarting firewalld]
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
If the GRUB install device has not been selected, then grub package
configuration will fail during upgrades.
Tests:
- Install freedombox package with this change in a VM. Check that the
diagnostic is passed.
- Re-install the grub-pc package with DEBIAN_FRONTEND set to
noninteractive, so that it fails to be configured. Check that the
diagnostic is failed.
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
Tests:
- Run affected privileged actions through UI and notice that secret strings are
not logged (except initializing init/info a new SSH repository).
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Run affected privileged actions through UI and notice that secret strings are
not logged (except deleting the last admin user).
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Run affected privileged actions through UI and notice that secret strings are
not logged.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Run affected privileged actions through UI and notice that secret strings are
not logged.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Run affected privileged actions through UI and notice that secret strings are
not logged.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Run affected privileged actions through UI and notice that secret strings are
not logged.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Fixes: #2435
Tests:
- Run affected privileged actions through UI and notice that secret strings are
not logged.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Run affected privileged actions through UI and notice that secret strings are
not logged.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Run affected privileged actions through UI and notice that secret strings are
not logged.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Run affected privileged actions through UI and notice that secret strings are
not logged.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Run affected privileged actions through UI and notice that secret strings are
not logged.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Perform effected actions and ensure that secrets are not logged on the
console.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
TiddlyWiki uses almost the same Apache configuration as Feather Wiki,
with one difference - disabling gzip for the `HEAD` request.
The FreedomBox app for TiddlyWiki is identical to Feather Wiki in
every other aspect.
- Proxy download through freedombox.org. This serves two purposes:
1. Upstream's website cannot track the IP addresses of FreedomBox users.
2. We can update the versions of the empty quine files without making
code changes in FreedomBox.
[sunil]
- Update description to correct the list of users who can access the app.
- Update logo to adhere to the logo guidelines.
- Minor styling fix.
- Update the copyright on the logo based on information from upstream git
repository.
Signed-off-by: Joseph Nuthalapati <njoseph@riseup.net>
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
This serves two purposes:
1. Upstream's website cannot track the IP addresses of FreedomBox users.
2. We can update the versions of the empty quine files without making
code changes in FreedomBox.
Signed-off-by: Joseph Nuthalapati <njoseph@riseup.net>
[sunil: Update description to reflect the change in upstream URL]
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.or>g
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
- Uninstall deletes wikis & extensions
- Use Skylark (v1.8.0)
- Add option to upload existing wiki
- Open wiki links in new tab. Since Feather Wiki modifies browser history, it
takes several clicks to go back and reach the FreedomBox app for Feather Wiki if
the user wants to switch to another wiki file. Opening in a new tab also makes
it easy for the user to move text between wikis (i.e. the Refile use case).
- Improve HTML file path handling. Extract only the HTML file name from the URL.
Return a 404 status if the file cannot be found
- Place featherwiki_nest.cgi file in /usr/lib/cgi-bin. The file is installed as
part of the FreedomBox package, rather than a step in the installation of
Feather Wiki.
[sunil]
- Reorganized description to complete the introduction before talking about
FreedomBox implementation.
- Update description to say that only users of 'wiki' group can access.
- Update description to talk about where the wiki is downloaded from how to
upgrade it.
- Update short description to 'Personal Notebooks'.
- Add UsersAndGroups component and to reuse 'wiki' group properly.
- Reorder component to resemble other apps (could prove useful in future).
- Restrict frontpage shortcut to 'wiki' group users.
- Minor styling updates. Run isort.
- Use pathlib.Path object where possible instead of os.path.
- Perform sanitization in privileged methods instead of callers. This leads
better security if the service is compromised.
- Perform duplicate checking in privileged methods instead of callers.
- Check in privileged action that uploaded file originates from temporary
directory. Otherwise, arbitrary files can moved into DAV directory.
- Switch storage path to /var/lib/ which is an application data folder from
/var/www which is a user data folder.
- Add extra security to the DAV folder by explicitly rejecting .htaccess
directives, forcing mime type and removing all options.
- Update SVG/PNG logo icons to adhere to our guidelines.
- Minor template updates. Add required attributes. Improve i18n. Avoid <p>
inside <p>.
- Refactor tests for more code reuse and fewer globals.
Signed-off-by: Joseph Nuthalapati <njoseph@riseup.net>
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
- DAV can simplify hosting the Feather Wiki app.
- It can also potentially be used to share folders over HTTP to clients such a
GNOME/KDE file mangers.
- Enabling the modules by default should have few disadvantages other than
slight increase in memory. It needs to be enabled with 'DAV on' directive on the
specific directories.
Tests:
- Running the service after patch run apache setup and the modules are enabled.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Tests:
- Without the changes, typing https://<domain>/nextcloud does not work. With the
changes it redirects to https://<domain>/nextcloud/.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
