--- twiki-4.0.5.orig/debian/patches/01_redirect_fix.dpatch +++ twiki-4.0.5/debian/patches/01_redirect_fix.dpatch @@ -0,0 +1,33 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## 01_redirect_fix.dpatch by +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: * prevent redirect code from allowing redirect to other hosts +## DP: (Closes: #404222) + +@DPATCH@ +diff -urNad un~/lib/TWiki.pm un/lib/TWiki.pm +--- un~/lib/TWiki.pm 2006-10-25 02:16:05.000000000 +0200 ++++ un/lib/TWiki.pm 2006-12-21 21:31:47.000000000 +0100 +@@ -720,6 +720,21 @@ + + ASSERT($this->isa( 'TWiki')) if DEBUG; + ++ # prevent phishing byt only allowing redirect to configured host ++ if( $url =~ m!^([^:]*://[^/]*)/*(.*)?$! ) { ++ my $host = $1; ++ #remove trailing /'s to match ++ $TWiki::cfg{DefaultUrlHost} =~ m!^([^:]*://[^/]*)/*(.*)?$!; ++ my $expected = $1; ++ unless ($host eq $expected) { ++ $url = $this->getOopsUrl( 'accessdenied', ++ def => 'topic_access', ++ web => $this->{web} || $TWiki::cfg{UsersWebName}, ++ topic => $this->{topic} || $TWiki::cfg{HomeTopicName}, ++ params => [ 'redirect', 'unsafe redirect to '.$url.': '.$host.' does not match DefaultUrlHost' ]); ++ } ++ } ++ + my $query = $this->{cgiQuery}; + unless( $this->{plugins}->redirectCgiQueryHandler( $query, $url ) ) { + if ( $query && $query->param( 'noredirect' )) { --- twiki-4.0.5.orig/debian/patches/00list +++ twiki-4.0.5/debian/patches/00list @@ -0,0 +1,3 @@ +01_redirect_fix.dpatch +01_formfields_with_name.dpatch +01_secure_sessions.dpatch --- twiki-4.0.5.orig/debian/patches/01_formfields_with_name.dpatch +++ twiki-4.0.5/debian/patches/01_formfields_with_name.dpatch @@ -0,0 +1,21 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## formfields_with_name.dpatch by +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: * enable FormFields containing Name +## DP: (Closes: #405571). + + +@DPATCH@ +diff -urNad twiki-4.0.5~/lib/TWiki/Form.pm twiki-4.0.5/lib/TWiki/Form.pm +--- twiki-4.0.5~/lib/TWiki/Form.pm 2006-10-25 02:16:05.000000000 +0200 ++++ twiki-4.0.5/lib/TWiki/Form.pm 2007-01-10 10:18:30.000000000 +0100 +@@ -254,7 +254,7 @@ + my @defn = (); + my $inBlock = 0; + foreach( split( /\r?\n/, $text ) ) { +- if( /^\s*\|.*Name[^|]*\|/ ) { ++ if( /^\s*\|\s*\*Name\*\s*\|/ ) { + $inBlock = 1; + } else { + if( /^\s*\|\s*([^|]*)\s*\|/ ) { --- twiki-4.0.5.orig/debian/patches/01_secure_sessions.dpatch +++ twiki-4.0.5/debian/patches/01_secure_sessions.dpatch @@ -0,0 +1,72 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## 01_secure_sessions.dpatch by +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: * secure the session files, and use file time to expire them +## DP: Arbitrary code execution in session files (CVE-2007-0669) (Closes #410256) + +@DPATCH@ +diff -urNad un~/lib/TWiki/Client.pm un/lib/TWiki/Client.pm +--- un~/lib/TWiki/Client.pm 2006-10-25 10:16:05.000000000 +1000 ++++ un/lib/TWiki/Client.pm 2007-02-10 23:55:15.000000000 +1100 +@@ -338,42 +338,28 @@ + =cut + + sub expireDeadSessions { +- my $time = time() || 0; ++ my $time = time() || 0; + my $exp = $TWiki::cfg{Sessions}{ExpireAfter} || 36000; # 10 hours + $exp = -$exp if $exp < 0; + +- opendir(D, $TWiki::cfg{Sessions}{Dir}) || return; +- foreach my $file ( grep { /cgisess_[0-9a-f]{32}/ } readdir(D) ) { ++ my $tmpFile = $TWiki::cfg{Sessions}{Dir}; ++ opendir(D, $tmpFile) || return; ++ foreach my $file ( grep { /^(passthru|cgisess)_[0-9a-f]{32}/ } readdir(D) ) { + $file = TWiki::Sandbox::untaintUnchecked( +- $TWiki::cfg{Sessions}{Dir}.'/'.$file ); +- my @stat = stat( $file ); +- # Kill small old files. They can't be valid sessions. +- # Ignore tiny new files. They can't be complete sessions. +- if( defined($stat[7]) && $stat[7] <= 50 ) { +- my $lat = $stat[8] || $stat[9] || $stat[10] || 0; +- unlink $file if( $time - $lat >= $exp ); +- next; +- } +- +- open(F, $file) || next; +- my $session = ; +- close F; +- +- # SMELL: security hazard? +- $session = TWiki::Sandbox::untaintUnchecked( $session ); +- +- my $D; +- eval $session; +- next if ( $@ ); +- # The session is expired if it is empty, hasn't been accessed in ages +- # or has exceeded its registered expiry time. +- if( !$D || $time >= $D->{_SESSION_ATIME} + $exp || +- $D->{_SESSION_ETIME} && $time >= $D->{_SESSION_ETIME} ) { +- unlink( $file ); +- next; +- } +- } +- closedir D; ++ $tmpFile.'/'.$file ); ++ my @stat = stat( $file ); ++ # CGI::Session updates the session file each time a browser views a ++ # topic setting the access and expiry time as values in the file. This ++ # also sets the mtime (modification time) for the file which is all we need. ++ # We know that the expiry time is mtime + $TWiki::cfg{Sessions}{ExpireAfter} ++ # so we do not need to waste execution time opening and reading the file. ++ # We just check the mtime. mtime is confirmed set in both Windows and Linux ++ # As a fallback we also check ctime. Files are deleted when they expire. ++ my $lat = $stat[9] || $stat[10] || 0; ++ unlink $file if ( $time - $lat >= $exp ); ++ next; ++ } ++ closedir D; + } + + =pod --- twiki-4.0.5.orig/debian/po/templates.pot +++ twiki-4.0.5/debian/po/templates.pot @@ -0,0 +1,93 @@ +# SOME DESCRIPTIVE TITLE. +# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER +# This file is distributed under the same license as the PACKAGE package. +# FIRST AUTHOR , YEAR. +# +#, fuzzy +msgid "" +msgstr "" +"Project-Id-Version: PACKAGE VERSION\n" +"Report-Msgid-Bugs-To: svenud@ozemail.com.au\n" +"POT-Creation-Date: 2007-02-14 17:20+1100\n" +"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" +"Last-Translator: FULL NAME \n" +"Language-Team: LANGUAGE \n" +"MIME-Version: 1.0\n" +"Content-Type: text/plain; charset=CHARSET\n" +"Content-Transfer-Encoding: 8bit\n" + +#. Type: string +#. Default +#: ../templates:1001 +msgid "http://localhost/" +msgstr "" + +#. Type: string +#. Description +#: ../templates:1002 +msgid "What is the top-level URL of the server TWiki runs under?" +msgstr "" + +#. Type: string +#. Description +#: ../templates:1002 +msgid "" +"For a normal install, this should be a URL for your web server's full name, " +"which is used to construct urls on some pages. The install will serve up " +"the data by adding \"twiki\" to the end of this setting; it is also needed " +"for certain redirections." +msgstr "" + +#. Type: string +#. Default +#: ../templates:2001 +msgid "webmaster@localhost" +msgstr "" + +#. Type: string +#. Description +#: ../templates:2002 +msgid "What is the email address of the webmaster for this TWiki?" +msgstr "" + +#. Type: string +#. Description +#: ../templates:2002 +msgid "" +"This email address gets mail for new user registration, and is listed on the " +"\"oops\" page when things go wrong." +msgstr "" + +#. Type: boolean +#. Description +#: ../templates:3001 +msgid "Install default wiki Topic Set on initial install?" +msgstr "" + +#. Type: boolean +#. Description +#: ../templates:3001 +msgid "" +"TWiki includes a complete \"starter kit\" which includes user registration " +"pages, documentation, and tutorials. Only decline if you're re-installing " +"twiki after deleting the package and want to keep the old data, or if you've " +"got a twiki data set from your own manual install. If data/Main/WebHome.txt " +"is present, the starter kit will not be unpacked. The the starter kit files " +"can be found in /usr/share/twiki/twiki-data.tar.gz (and twiki-pub.tar.gz), " +"if you want to install it manually or compare your topics with the new " +"version)" +msgstr "" + +#. Type: note +#. Description +#: ../templates:4001 +msgid "Admin User Registration configuration required" +msgstr "" + +#. Type: note +#. Description +#: ../templates:4001 +msgid "" +"After you have created yourself a user, edit the Main.TWikiAdminGroup to " +"restrict Admin privileges to that user." +msgstr "" --- twiki-4.0.5.orig/debian/po/br.po +++ twiki-4.0.5/debian/po/br.po @@ -0,0 +1,119 @@ +# +# Translators, if you are not familiar with the PO format, gettext +# documentation is worth reading, especially sections dedicated to +# this format, e.g. by running: +# info -n '(gettext)PO Files' +# info -n '(gettext)Header Entry' +# +# Some information specific to po-debconf are available at +# /usr/share/doc/po-debconf/README-trans +# or http://www.debian.org/intl/l10n/po-debconf/README-trans +# +# Developers do not need to manually edit POT or PO files. +# +#, fuzzy +msgid "" +msgstr "" +"Project-Id-Version: TWiki\n" +"Report-Msgid-Bugs-To: svenud@ozemail.com.au\n" +"POT-Creation-Date: 2007-02-14 17:20+1100\n" +"PO-Revision-Date: 2004-08-23 00:00-0300\n" +"Last-Translator: Tiago Bortoletto Vaz \n" +"Language-Team: Debian-BR Project \n" +"MIME-Version: 1.0\n" +"Content-Type: text/plain; charset=ISO-8859-1\n" +"Content-Transfer-Encoding: 8bit\n" + +#. Type: string +#. Default +#: ../templates:1001 +msgid "http://localhost/" +msgstr "" + +#. Type: string +#. Description +#: ../templates:1002 +msgid "What is the top-level URL of the server TWiki runs under?" +msgstr "Qual é a URL de mais alto nível do servidor que o TWiki irá rodar?" + +#. Type: string +#. Description +#: ../templates:1002 +msgid "" +"For a normal install, this should be a URL for your web server's full name, " +"which is used to construct urls on some pages. The install will serve up " +"the data by adding \"twiki\" to the end of this setting; it is also needed " +"for certain redirections." +msgstr "" +"Para uma instalação normal, isto deve ser uma URL do nome completo do seu " +"servidor WEB, que é usada como base das urls de algumas páginas. A " +"instalação irá prover os dados adicionando \"twiki\" no final desta URL; " +"isso também é necessário para alguns redirecionamentos." + +#. Type: string +#. Default +#: ../templates:2001 +msgid "webmaster@localhost" +msgstr "" + +#. Type: string +#. Description +#: ../templates:2002 +msgid "What is the email address of the webmaster for this TWiki?" +msgstr "Qual o endereço de email do webmaster deste TWiki?" + +#. Type: string +#. Description +#: ../templates:2002 +msgid "" +"This email address gets mail for new user registration, and is listed on the " +"\"oops\" page when things go wrong." +msgstr "" +"Este endereço de email recebe os emails dos novos registros de usuários, e é " +"listado na página \"oops\" quando algo der errado." + +#. Type: boolean +#. Description +#: ../templates:3001 +#, fuzzy +msgid "Install default wiki Topic Set on initial install?" +msgstr "Instalar os exemplos padrão de wiki na instalação inicial?" + +#. Type: boolean +#. Description +#: ../templates:3001 +#, fuzzy +msgid "" +"TWiki includes a complete \"starter kit\" which includes user registration " +"pages, documentation, and tutorials. Only decline if you're re-installing " +"twiki after deleting the package and want to keep the old data, or if you've " +"got a twiki data set from your own manual install. If data/Main/WebHome.txt " +"is present, the starter kit will not be unpacked. The the starter kit files " +"can be found in /usr/share/twiki/twiki-data.tar.gz (and twiki-pub.tar.gz), " +"if you want to install it manually or compare your topics with the new " +"version)" +msgstr "" +"O TWiki inclui um completo \"kit de inicialização\" que inclui páginas de " +"registro de usuário, documentação e tutoriais. Se você está reinstalando o " +"twiki depois de ter removido o pacote anterior e quer preservar os dados " +"antigos, ou se você tem os dados de configuração do twiki a partir do seu " +"próprio manual de instalação, você deve recusar aqui. Numa instalação " +"inicial normal, aceitando essa opção, dados de exemplo de configuração serão " +"instalados em /var/lib/twiki/data. (Num outro caso, se data/Main/WebHome.txt " +"está presente, o kit de inicialização não será desempacotado; você pode " +"encontrá-lo em /usr/share/doc/twiki/twiki-data.tar.gz se quiser instalá-lo " +"manualmente ou comparar com uma nova versão.)" + +#. Type: note +#. Description +#: ../templates:4001 +msgid "Admin User Registration configuration required" +msgstr "" + +#. Type: note +#. Description +#: ../templates:4001 +msgid "" +"After you have created yourself a user, edit the Main.TWikiAdminGroup to " +"restrict Admin privileges to that user." +msgstr "" --- twiki-4.0.5.orig/debian/po/cs.po +++ twiki-4.0.5/debian/po/cs.po @@ -0,0 +1,139 @@ +# +# Translators, if you are not familiar with the PO format, gettext +# documentation is worth reading, especially sections dedicated to +# this format, e.g. by running: +# info -n '(gettext)PO Files' +# info -n '(gettext)Header Entry' +# +# Some information specific to po-debconf are available at +# /usr/share/doc/po-debconf/README-trans +# or http://www.debian.org/intl/l10n/po-debconf/README-trans +# +# Developers do not need to manually edit POT or PO files. +# +msgid "" +msgstr "" +"Project-Id-Version: twiki\n" +"Report-Msgid-Bugs-To: svenud@ozemail.com.au\n" +"POT-Creation-Date: 2007-02-14 17:20+1100\n" +"PO-Revision-Date: 2007-01-27 17:34+0100\n" +"Last-Translator: Miroslav Kure \n" +"Language-Team: Czech \n" +"MIME-Version: 1.0\n" +"Content-Type: text/plain; charset=UTF-8\n" +"Content-Transfer-Encoding: 8bit\n" + +#. Type: string +#. Default +#: ../templates:1001 +msgid "http://localhost/" +msgstr "http://localhost/" + +#. Type: string +#. Description +#: ../templates:1002 +msgid "What is the top-level URL of the server TWiki runs under?" +msgstr "Jaké je vrcholové URL serveru, pod kterým TWiki poběží?" + +#. Type: string +#. Description +#: ../templates:1002 +msgid "" +"For a normal install, this should be a URL for your web server's full name, " +"which is used to construct urls on some pages. The install will serve up " +"the data by adding \"twiki\" to the end of this setting; it is also needed " +"for certain redirections." +msgstr "" +"Pro běžné instalace by to mÄ›la být celá adresa vaÅ¡eho webového serveru. " +"Instalace pÅ™idá na konec této adresy Å™etÄ›zec \"twiki\", Äímž vznikne URL, " +"pod kterým bude vaÅ¡e wiki dostupné. Zadané URL se použije pro vytváření " +"odkazů na nÄ›kterých stránkách." + +#. Type: string +#. Default +#: ../templates:2001 +msgid "webmaster@localhost" +msgstr "webmaster@localhost" + +#. Type: string +#. Description +#: ../templates:2002 +msgid "What is the email address of the webmaster for this TWiki?" +msgstr "Jaká je e-mailová adresa správce tohoto TWiki?" + +#. Type: string +#. Description +#: ../templates:2002 +msgid "" +"This email address gets mail for new user registration, and is listed on the " +"\"oops\" page when things go wrong." +msgstr "" +"Na tuto emailovou adresu budou zasílány požadavky o registraci nových " +"uživatelů a také se bude zobrazovat na webové stránce v případÄ›, že se vÄ›ci " +"pokazí." + +#. Type: boolean +#. Description +#: ../templates:3001 +#, fuzzy +msgid "Install default wiki Topic Set on initial install?" +msgstr "Instalovat pÅ™i prvotní instalaci vzorový wiki web?" + +#. Type: boolean +#. Description +#: ../templates:3001 +#, fuzzy +msgid "" +"TWiki includes a complete \"starter kit\" which includes user registration " +"pages, documentation, and tutorials. Only decline if you're re-installing " +"twiki after deleting the package and want to keep the old data, or if you've " +"got a twiki data set from your own manual install. If data/Main/WebHome.txt " +"is present, the starter kit will not be unpacked. The the starter kit files " +"can be found in /usr/share/twiki/twiki-data.tar.gz (and twiki-pub.tar.gz), " +"if you want to install it manually or compare your topics with the new " +"version)" +msgstr "" +"TWiki obsahuje kompletní \"sadu pro zaÄáteÄníky\", která zahrnuje stránky s " +"registrací uživatelů, dokumentací a návody. Reinstalujete-li twiki po " +"pÅ™edchozím odstranÄ›ní balíku a chcete zachovat svá stará data, nebo pokud " +"máte data po dřívÄ›jší ruÄní instalaci, mÄ›li byste zde zamítnout. PÅ™i běžné " +"první instalaci akceptujte, což vám nainstaluje vzorová data do /var/lib/" +"twiki/data (a /var/www/twiki/pub). (Sada pro zaÄáteÄníky se nerozbalí, pokud " +"existuje soubor data/Main/WebHome.txt; budete-li ji chtít nainstalovat " +"ruÄnÄ›, nachází se v souboru /usr/share/doc/twiki/twiki-data.tar.gz (a twiki-" +"pub.tar.gz).)" + +#. Type: note +#. Description +#: ../templates:4001 +msgid "Admin User Registration configuration required" +msgstr "Vyžadována zmÄ›na v nastavení registrace uživatelů" + +#. Type: note +#. Description +#: ../templates:4001 +msgid "" +"After you have created yourself a user, edit the Main.TWikiAdminGroup to " +"restrict Admin privileges to that user." +msgstr "" +"Až si pro sebe vytvoříte uživatele, upravte Main.TWikiAdminGroup a omezte " +"správcovská oprávnÄ›ní na vytvoÅ™eného uživatele." + +#~ msgid "" +#~ "The default debian installation of the TWiki is configured to create new " +#~ "users automatically when a user Registers. This is not as secure as the " +#~ "default TWiki but is more useful for trying TWiki out. To change it so " +#~ "the users are created manually by the administrator use TWiki RenameTopic " +#~ "to rename the TWikiRegistration to TWikiRegistrationPub, and " +#~ "TWikiRegistrationDefault to TWikiRegistration. IMPORTANT: After you have " +#~ "created yourself a user, edit the Main.TWikiAdminGroup to restrict Admin " +#~ "privileges" +#~ msgstr "" +#~ "Výchozí instalace TWiki v Debianu je nastavena tak, aby pÅ™i registraci " +#~ "uživatele automaticky vytvářela nové uživatele. To není tak bezpeÄné, " +#~ "jako výchozí nastavení TWiki, avÅ¡ak pro pouhé vyzkouÅ¡ení TWiki je to " +#~ "užiteÄnÄ›jší. ZmÄ›nu, aby uživatele zakládal administrátor ruÄnÄ›, provedete " +#~ "pomocí TWiki RenameToppic, kde pÅ™ejmenujete TWikiRegistration na " +#~ "TWikiRegistrationPub a poté TWikiRegistrationDefault na " +#~ "TWikiRegistration. DÅ®LEŽITÉ: Až si pro sebe vytvoříte uživatele, omezte " +#~ "administrátorská oprávnÄ›ní úpravou Main.TWikiAdminGroup." --- twiki-4.0.5.orig/debian/po/pt_BR.po +++ twiki-4.0.5/debian/po/pt_BR.po @@ -0,0 +1,119 @@ +# +# Translators, if you are not familiar with the PO format, gettext +# documentation is worth reading, especially sections dedicated to +# this format, e.g. by running: +# info -n '(gettext)PO Files' +# info -n '(gettext)Header Entry' +# +# Some information specific to po-debconf are available at +# /usr/share/doc/po-debconf/README-trans +# or http://www.debian.org/intl/l10n/po-debconf/README-trans +# +# Developers do not need to manually edit POT or PO files. +# +#, fuzzy +msgid "" +msgstr "" +"Project-Id-Version: twiki_20030201-5\n" +"Report-Msgid-Bugs-To: svenud@ozemail.com.au\n" +"POT-Creation-Date: 2007-02-14 17:20+1100\n" +"PO-Revision-Date: 2005-09-04A 13:45-0300\n" +"Last-Translator: Antonio S. de A. Terceiro \n" +"Language-Team: TWikiBrasil \n" +"MIME-Version: 1.0\n" +"Content-Type: text/plain; charset=utf-8\n" +"Content-Transfer-Encoding: 8bit\n" + +#. Type: string +#. Default +#: ../templates:1001 +msgid "http://localhost/" +msgstr "" + +#. Type: string +#. Description +#: ../templates:1002 +msgid "What is the top-level URL of the server TWiki runs under?" +msgstr "Qual a URL inicial do servidor onde o TWiki roda?" + +#. Type: string +#. Description +#: ../templates:1002 +msgid "" +"For a normal install, this should be a URL for your web server's full name, " +"which is used to construct urls on some pages. The install will serve up " +"the data by adding \"twiki\" to the end of this setting; it is also needed " +"for certain redirections." +msgstr "" +"Para uma instalação normal, essa deve deve a URL pro nome completo do seu " +"servidor, que é usada para construir URL's am alguma páginas. A instalação " +"vai fornecer essa informação adicionando \"twiki\" ao final desse valor; é " +"necessário também pra alguns redirecionamentos." + +#. Type: string +#. Default +#: ../templates:2001 +msgid "webmaster@localhost" +msgstr "" + +#. Type: string +#. Description +#: ../templates:2002 +msgid "What is the email address of the webmaster for this TWiki?" +msgstr "Qual o endereço de e-mail to webmaster desse TWiki?" + +#. Type: string +#. Description +#: ../templates:2002 +msgid "" +"This email address gets mail for new user registration, and is listed on the " +"\"oops\" page when things go wrong." +msgstr "" +"Esse endereço de e-mail recebe mensagens em registros de novos usuários, e é " +"listado na página \"oops\" quando alguma coisa dá errado." + +#. Type: boolean +#. Description +#: ../templates:3001 +#, fuzzy +msgid "Install default wiki Topic Set on initial install?" +msgstr "Instalar universo wiki inicial na primeira instalação?" + +#. Type: boolean +#. Description +#: ../templates:3001 +#, fuzzy +msgid "" +"TWiki includes a complete \"starter kit\" which includes user registration " +"pages, documentation, and tutorials. Only decline if you're re-installing " +"twiki after deleting the package and want to keep the old data, or if you've " +"got a twiki data set from your own manual install. If data/Main/WebHome.txt " +"is present, the starter kit will not be unpacked. The the starter kit files " +"can be found in /usr/share/twiki/twiki-data.tar.gz (and twiki-pub.tar.gz), " +"if you want to install it manually or compare your topics with the new " +"version)" +msgstr "" +"O TWiki inclui um \"kit inicial\" completo que inclui páginas de registro de " +"usuários, documentação e tutoriais. Se você estiver reinstalando twiki " +"depois de remover o pacote e quiser manter os dados antigos, ou se você tem " +"um conjunto de dados do twiki de uma instalação manual própria, você deve " +"negar aqui. Numa instalação inicial normal, aceite, e um conjunto de dados " +"inicial vai ser instalado em /var/lib/twiki/data (e /var/www/twiki/pub). " +"(Emqualquer um dos casos, se data/Main/WebHome.txt estiver presente, o " +"kitinicial não vai ser extraído; você pode olhar em /usr/share/doc/twiki/" +"twiki-data.tar.gz (e twiki-pub.tar.gz) se quiser instalá-lo manualmente ou " +"comparar com uma versão mais nova.)" + +#. Type: note +#. Description +#: ../templates:4001 +msgid "Admin User Registration configuration required" +msgstr "" + +#. Type: note +#. Description +#: ../templates:4001 +msgid "" +"After you have created yourself a user, edit the Main.TWikiAdminGroup to " +"restrict Admin privileges to that user." +msgstr "" --- twiki-4.0.5.orig/debian/po/fr.po +++ twiki-4.0.5/debian/po/fr.po @@ -0,0 +1,121 @@ +# +# Translators, if you are not familiar with the PO format, gettext +# documentation is worth reading, especially sections dedicated to +# this format, e.g. by running: +# info -n '(gettext)PO Files' +# info -n '(gettext)Header Entry' +# Some information specific to po-debconf are available at +# /usr/share/doc/po-debconf/README-trans +# or http://www.debian.org/intl/l10n/po-debconf/README-trans# +# Developers do not need to manually edit POT or PO files. +# +msgid "" +msgstr "" +"Project-Id-Version: twiki_1:4.0.5-4\n" +"Report-Msgid-Bugs-To: svenud@ozemail.com.au\n" +"POT-Creation-Date: 2007-02-14 17:20+1100\n" +"PO-Revision-Date: 2006-12-08 21:54+0100\n" +"Last-Translator: Michel Grentzinger \n" +"Language-Team: French \n" +"MIME-Version: 1.0\n" +"Content-Type: text/plain; charset=ISO-8859-15\n" +"Content-Transfer-Encoding: 8bit\n" + +#. Type: string +#. Default +#: ../templates:1001 +msgid "http://localhost/" +msgstr "http://localhost/" + +#. Type: string +#. Description +#: ../templates:1002 +msgid "What is the top-level URL of the server TWiki runs under?" +msgstr "URL du serveur TWiki :" + +#. Type: string +#. Description +#: ../templates:1002 +msgid "" +"For a normal install, this should be a URL for your web server's full name, " +"which is used to construct urls on some pages. The install will serve up " +"the data by adding \"twiki\" to the end of this setting; it is also needed " +"for certain redirections." +msgstr "" +"Pour une installation normale, vous devriez indiquer l'URL construite à " +"partir du nom complet de votre serveur. Les données seront accessibles à " +"l'adresse indiquée en ajoutant twiki à cette valeur. Celle-ci servira " +"également pour certaines redirections." + +#. Type: string +#. Default +#: ../templates:2001 +msgid "webmaster@localhost" +msgstr "webmaster@localhost" + +#. Type: string +#. Description +#: ../templates:2002 +msgid "What is the email address of the webmaster for this TWiki?" +msgstr "Adresse électronique du webmestre de TWiki :" + +#. Type: string +#. Description +#: ../templates:2002 +msgid "" +"This email address gets mail for new user registration, and is listed on the " +"\"oops\" page when things go wrong." +msgstr "" +"L'adresse électronique indiqué recevra les demandes d'enregistrement des " +"nouveaux utilisateurs. Elle est affichée sur la page oops lorsque un " +"incident se produit." + +#. Type: boolean +#. Description +#: ../templates:3001 +#, fuzzy +msgid "Install default wiki Topic Set on initial install?" +msgstr "" +"Faut-il installer l'exemple d'univers wiki lors de l'installation initiale ?" + +#. Type: boolean +#. Description +#: ../templates:3001 +#, fuzzy +msgid "" +"TWiki includes a complete \"starter kit\" which includes user registration " +"pages, documentation, and tutorials. Only decline if you're re-installing " +"twiki after deleting the package and want to keep the old data, or if you've " +"got a twiki data set from your own manual install. If data/Main/WebHome.txt " +"is present, the starter kit will not be unpacked. The the starter kit files " +"can be found in /usr/share/twiki/twiki-data.tar.gz (and twiki-pub.tar.gz), " +"if you want to install it manually or compare your topics with the new " +"version)" +msgstr "" +"TWiki comprend un kit de démarrage complet qui inclut des pages destinées à " +"l'enregistrement des utilisateurs, de la documentation et des tutoriels. Si " +"vous réinstallez twiki après avoir supprimé le paquet et que vous souhaitez " +"conserver vos anciennes données ou si vous avez un ensemble de données twiki " +"provenant d'une installation que vous avez faite vous-même, ne choisissez " +"pas cette option. Pour une installation normale, vous pouvez la choisir et " +"un ensemble simple de données sera installé dans /var/lib/twiki/data (et /" +"var/www/twiki/pub). Dans tous les cas, si data/Main/WebHome.txt existe, le " +"kit de démarrage ne sera pas décompacté. Vous pourrez alors regarder dans /" +"usr/share/doc/twiki/twiki-data.tar.gz (et twiki-pub.tar.gz) si vous " +"souhaitez l'installer vous-même ou le comparer à une nouvelle version." + +#. Type: note +#. Description +#: ../templates:4001 +msgid "Admin User Registration configuration required" +msgstr "Configuration obligatoire de l'enregistrement des utilisateurs" + +#. Type: note +#. Description +#: ../templates:4001 +msgid "" +"After you have created yourself a user, edit the Main.TWikiAdminGroup to " +"restrict Admin privileges to that user." +msgstr "" +"Après avoir créé un utilisateur, veuillez éditer Main.TWikiAdminGroup pour " +"restreindre les privilèges de l'administrateur à cet utilisateur." --- twiki-4.0.5.orig/debian/po/sv.po +++ twiki-4.0.5/debian/po/sv.po @@ -0,0 +1,139 @@ +# +# Translators, if you are not familiar with the PO format, gettext +# documentation is worth reading, especially sections dedicated to +# this format, e.g. by running: +# info -n '(gettext)PO Files' +# info -n '(gettext)Header Entry' +# +# Some information specific to po-debconf are available at +# /usr/share/doc/po-debconf/README-trans +# or http://www.debian.org/intl/l10n/po-debconf/README-trans +# +# Developers do not need to manually edit POT or PO files. +# +msgid "" +msgstr "" +"Project-Id-Version: twiki 20040902-3\n" +"Report-Msgid-Bugs-To: svenud@ozemail.com.au\n" +"POT-Creation-Date: 2007-02-14 17:20+1100\n" +"PO-Revision-Date: 2005-11-28 12:30+0100\n" +"Last-Translator: Daniel Nylander \n" +"Language-Team: Swedish \n" +"MIME-Version: 1.0\n" +"Content-Type: text/plain; charset=utf-8\n" +"Content-Transfer-Encoding: 8bit\n" + +#. Type: string +#. Default +#: ../templates:1001 +msgid "http://localhost/" +msgstr "http://localhost/" + +#. Type: string +#. Description +#: ../templates:1002 +msgid "What is the top-level URL of the server TWiki runs under?" +msgstr "Vilken är topp-nivÃ¥-URLen för servern som TWiki kör under?" + +#. Type: string +#. Description +#: ../templates:1002 +msgid "" +"For a normal install, this should be a URL for your web server's full name, " +"which is used to construct urls on some pages. The install will serve up " +"the data by adding \"twiki\" to the end of this setting; it is also needed " +"for certain redirections." +msgstr "" +"För en normal installation bör detta vara en URL för din webbservers fulla " +"namn som används för att konstruera URLer för vissa sidor. Installationen " +"kommer att servera data genom att lägga till \"twiki\" pÃ¥ slutet av denna " +"inställning; den behövs ocksÃ¥ för vissa omdirigeringar." + +#. Type: string +#. Default +#: ../templates:2001 +msgid "webmaster@localhost" +msgstr "webmaster@localhost" + +#. Type: string +#. Description +#: ../templates:2002 +msgid "What is the email address of the webmaster for this TWiki?" +msgstr "Vad är e-postadressen för webmastern för denna TWiki?" + +#. Type: string +#. Description +#: ../templates:2002 +msgid "" +"This email address gets mail for new user registration, and is listed on the " +"\"oops\" page when things go wrong." +msgstr "" +"Denna e-postadress tar emot e-post för nya användarregistreringar och är " +"listad pÃ¥ sidan \"oops\" när saker gÃ¥r fel." + +#. Type: boolean +#. Description +#: ../templates:3001 +#, fuzzy +msgid "Install default wiki Topic Set on initial install?" +msgstr "Installera exempeldata vid initiell installation?" + +#. Type: boolean +#. Description +#: ../templates:3001 +#, fuzzy +msgid "" +"TWiki includes a complete \"starter kit\" which includes user registration " +"pages, documentation, and tutorials. Only decline if you're re-installing " +"twiki after deleting the package and want to keep the old data, or if you've " +"got a twiki data set from your own manual install. If data/Main/WebHome.txt " +"is present, the starter kit will not be unpacked. The the starter kit files " +"can be found in /usr/share/twiki/twiki-data.tar.gz (and twiki-pub.tar.gz), " +"if you want to install it manually or compare your topics with the new " +"version)" +msgstr "" +"TWiki inkluderar ett komplett \"startkit\" som inkluderar sidor för " +"användarregistrering, dokumentation och genomgÃ¥ngar. Om du installerar om " +"twiki efter att ha tagit bort paketet och vill behÃ¥lla det gamla datat eller " +"om du har twiki-data frÃ¥n din egna manuella installtion bör du svara \"nej\" " +"här. Vid en normal initial installation, säg \"ja\" och exempeldata kommer " +"att installeras i /var/lib/twiki/data (och /var/www/twiki/pub). (I bÃ¥da " +"fallen, om data/Main/WebHome.txt finns kommer startkitet inte att packas " +"upp; du kan se i /usr/share/doc/twiki/twiki-data.tar.gz (och twiki-pub.tar." +"zg) om du önskar att installera det manuellt eller att att jämföra med en ny " +"version.)" + +#. Type: note +#. Description +#: ../templates:4001 +#, fuzzy +msgid "Admin User Registration configuration required" +msgstr "Konfiguration av användarregistrering krävs" + +#. Type: note +#. Description +#: ../templates:4001 +msgid "" +"After you have created yourself a user, edit the Main.TWikiAdminGroup to " +"restrict Admin privileges to that user." +msgstr "" + +#~ msgid "" +#~ "The default debian installation of the TWiki is configured to create new " +#~ "users automatically when a user Registers. This is not as secure as the " +#~ "default TWiki but is more useful for trying TWiki out. To change it so " +#~ "the users are created manually by the administrator use TWiki RenameTopic " +#~ "to rename the TWikiRegistration to TWikiRegistrationPub, and " +#~ "TWikiRegistrationDefault to TWikiRegistration. IMPORTANT: After you have " +#~ "created yourself a user, edit the Main.TWikiAdminGroup to restrict Admin " +#~ "privileges" +#~ msgstr "" +#~ "Standardinstallation i Debian av TWiki är konfigurerad att skapa nya " +#~ "användare automatiskt när en användare registrerar sig. Detta är inte sÃ¥ " +#~ "säkert som standarden i TWiki men är mer användbar för att prova pÃ¥ " +#~ "TWiki. För att ändra det sÃ¥ att användare som skapas manuellt av " +#~ "administratören använd TWiki RenameTopic för att byta namn pÃ¥ " +#~ "TWikiRegistration till TWikiRegistrationPub och TWikiRegistrationDefault " +#~ "till TWikiRegistration. VIKTIGT: Efter att du har skapat din egna " +#~ "användare, redigera Main.TWikiAdminGroup för att begränsa " +#~ "administrationsrättigheterna." --- twiki-4.0.5.orig/debian/po/POTFILES.in +++ twiki-4.0.5/debian/po/POTFILES.in @@ -0,0 +1 @@ +[type: gettext/rfc822deb] templates --- twiki-4.0.5.orig/debian/po/vi.po +++ twiki-4.0.5/debian/po/vi.po @@ -0,0 +1,133 @@ +# Vietnamese translation for twiki. +# Copyright © 2005 Free Software Foundation, Inc. +# Clytie Siddall , 2005. +# +msgid "" +msgstr "" +"Project-Id-Version: twiki 20040902-3\n" +"Report-Msgid-Bugs-To: svenud@ozemail.com.au\n" +"POT-Creation-Date: 2007-02-14 17:20+1100\n" +"PO-Revision-Date: 2005-08-10 22:45+0930\n" +"Last-Translator: Clytie Siddall \n" +"Language-Team: Vietnamese \n" +"MIME-Version: 1.0\n" +"Content-Type: text/plain; charset=utf-8\n" +"Content-Transfer-Encoding: 8bit\n" +"Plural-Forms: nplurals=1; plural=0\n" +"X-Generator: LocFactoryEditor 1.2.2\n" + +#. Type: string +#. Default +#: ../templates:1001 +msgid "http://localhost/" +msgstr "http://localhost/" + +#. Type: string +#. Description +#: ../templates:1002 +msgid "What is the top-level URL of the server TWiki runs under?" +msgstr "TWiki chạy trên máy phục vụ có địa chỉ Mạng cấp đầu nào?" + +#. Type: string +#. Description +#: ../templates:1002 +msgid "" +"For a normal install, this should be a URL for your web server's full name, " +"which is used to construct urls on some pages. The install will serve up " +"the data by adding \"twiki\" to the end of this setting; it is also needed " +"for certain redirections." +msgstr "" +"Khi cài đặt má»™t cách chuẩn, giá trị này nên là má»™t địa chỉ Mạng cho tên đầy " +"đủ của trình phục vụ Mạng bạn, mà được dùng để tạo địa chỉ Mạng trong má»™t số " +"trang. Việc cài đặt sẽ cung cấp dữ liệu bằng cách thêm « twiki » vào kết " +"thức giá trị này; cÅ©ng cần thiết nó để chuyển hÆ°á»›ng trong má»™t số trÆ°á»ng hợp." + +#. Type: string +#. Default +#: ../templates:2001 +msgid "webmaster@localhost" +msgstr "webmaster@localhost" + +#. Type: string +#. Description +#: ../templates:2002 +msgid "What is the email address of the webmaster for this TWiki?" +msgstr "Cho TWiki này, ngÆ°á»i chủ nÆ¡i Mạng có địa chỉ thÆ° nào?" + +#. Type: string +#. Description +#: ../templates:2002 +msgid "" +"This email address gets mail for new user registration, and is listed on the " +"\"oops\" page when things go wrong." +msgstr "" +"Äịa chỉ thÆ° này nhận thÆ° khi ngÆ°á»i dùng má»›i đăng ký, và xuất hiện trong " +"trang « ối » (oops) khi gặp lá»—i." + +#. Type: boolean +#. Description +#: ../templates:3001 +#, fuzzy +msgid "Install default wiki Topic Set on initial install?" +msgstr "Cài đặt môi trÆ°á»ng wiki mẫu khi cài đặt đầu tiên không?" + +#. Type: boolean +#. Description +#: ../templates:3001 +#, fuzzy +msgid "" +"TWiki includes a complete \"starter kit\" which includes user registration " +"pages, documentation, and tutorials. Only decline if you're re-installing " +"twiki after deleting the package and want to keep the old data, or if you've " +"got a twiki data set from your own manual install. If data/Main/WebHome.txt " +"is present, the starter kit will not be unpacked. The the starter kit files " +"can be found in /usr/share/twiki/twiki-data.tar.gz (and twiki-pub.tar.gz), " +"if you want to install it manually or compare your topics with the new " +"version)" +msgstr "" +"TWiki bao gồm má»™t bá»™ dụng cụ bắt đầu hoàn thành, gồm trang đăng ký ngÆ°á»i " +"dùng, tài liệu và trợ lý há»c tập. Nếu bạn Ä‘ang cài đặt lại twiki sau khi xóa " +"bá» gói và muốn giữ các dữ liệu cÅ©, hoặc nếu bạn có dữ liệu twiki từ việc cài " +"đặt thủ công, thì bạn nên nói « Không » (no) tại đây. Khi cài đặt đầu tiên " +"má»™t cách chuẩn, hãy nói « Có » (yes), và má»™t bá»™ dữ liệu mẫu sẽ được cài đặt " +"vào « /var/lib/twiki/data » (và vào « /var/www/twiki/pub »). (Trong cả hai " +"trÆ°á»ng hợp, nếu có « data/Main/WebHome.txt » thì sẽ không giải nén bá»™ dụng " +"cụ bắt đầu; bạn có thể xem trong « /usr/share/doc/twiki/twiki-data.tar.gz " +"» (và trong « twiki-pub.tar.gz ») nếu bạn muốn tá»± cài đặt nó, hoặc muốn so " +"sánh vá»›i má»™t phiên bản má»›i." + +#. Type: note +#. Description +#: ../templates:4001 +#, fuzzy +msgid "Admin User Registration configuration required" +msgstr "Cần thiết cấu hình đăng ký ngÆ°á»i dùng" + +#. Type: note +#. Description +#: ../templates:4001 +msgid "" +"After you have created yourself a user, edit the Main.TWikiAdminGroup to " +"restrict Admin privileges to that user." +msgstr "" + +#~ msgid "" +#~ "The default debian installation of the TWiki is configured to create new " +#~ "users automatically when a user Registers. This is not as secure as the " +#~ "default TWiki but is more useful for trying TWiki out. To change it so " +#~ "the users are created manually by the administrator use TWiki RenameTopic " +#~ "to rename the TWikiRegistration to TWikiRegistrationPub, and " +#~ "TWikiRegistrationDefault to TWikiRegistration. IMPORTANT: After you have " +#~ "created yourself a user, edit the Main.TWikiAdminGroup to restrict Admin " +#~ "privileges" +#~ msgstr "" +#~ "Bản cài đặt TWiki Debian mặc định được cấu hình để tá»± Ä‘á»™ng tạo ngÆ°á»i dùng " +#~ "má»›i khi ngÆ°á»i ấy đăng ký. Cách này không phải bảo mật nhÆ° TWiki mặc định, " +#~ "nhÆ°ng mà hữu ích hÆ¡n khi thá»­ ra TWiki. Äể thay đổi thiết lập này, để mà " +#~ "quản trị tá»± tạo ngÆ°á»i dùng, hãy dùng « TWiki RenameTopic » (TWiki thay " +#~ "đổi tên của chủ Ä‘á») để thay đổi tên của TWikiRegistration (Ä‘ang ký TWiki) " +#~ "thành TWikiRegistrationPub (Ä‘ang ký công TWiki), và " +#~ "TWikiRegistrationDefault (Ä‘ang ký TWiki mặc định) thành TWikiRegistration " +#~ "(Ä‘ang ký TWiki). QUAN TRỌNG: sau khi bạn đã tạo ngÆ°á»i dùng cho chính bạn, " +#~ "hãy hiệu chỉnh Main.TWikiAdminGroup (chính: nhóm quản lý TWiki) để giá»›i " +#~ "hạn quyá»n truy cập quản lý." --- twiki-4.0.5.orig/debian/control +++ twiki-4.0.5/debian/control @@ -0,0 +1,17 @@ +Source: twiki +Section: web +Priority: optional +Maintainer: Sven Dowideit +Uploaders: Amaya Rodrigo Sastre +Build-Depends: debhelper (>= 5), tardy, po-debconf, dpatch +Standards-Version: 3.7.2 + +Package: twiki +Architecture: all +Depends: ${perl:Depends} (>= 5.8), libnet-perl, libmime-base64-perl, rcs (>= 5.7), apache-common | apache2-common | apache2.2-common, debconf (>= 0.5) | debconf-2.0, libalgorithm-diff-perl, liberror-perl, libdigest-sha1-perl, libtext-diff-perl, liblocale-maketext-lexicon-perl, libcgi-session-perl, liburi-perl, libhtml-parser-perl +Suggests: libunicode-maputf8-perl +Description: A Web Based Collaboration Platform + TWiki is a modern CGI-based implementation of the Wiki collaboration platform + originally developed for OOP/Patterns collaboration. In addition to the + traditional Wiki feature of allowing any web browser to serve as a contributing + client, TWiki adds rcs-based version control and user management. --- twiki-4.0.5.orig/debian/BUGS.Debian +++ twiki-4.0.5/debian/BUGS.Debian @@ -0,0 +1,33 @@ +Bugs specific to the debian packaging [pre-upload]: + +* document the rest too +* need to enable authentication somehow (what is openafs doing for htaccess?) + * so, using TWikiRegistrationPub gives you a different screen, but that + just changes what questions you get asked + * login only happens as an oops-side-effect, so something has to actually + *fail* to trigger it; + * also, has the override semantics that doesn't +* office location stuff still in by default (what did openafs do?) +* make debconf-editted files not conffiles (but open discussion on them too) + +Done: +* config debconf stuff may need to move to postinst [fixed based on debian-devel(8)] +* improve uid-clearing line (fail if www-data) [don't] +* document use of statoverride in readme [done] +* .lock files remain around? (may not be a bug) [not a bug, edit lock box] +* how much of data/ should be conffiles? all of it? + ** perhaps data should be an initial set that gets installed from postinst[done] +* is www-data right for ownership, or should we have a new user id?[done] + ** no, use twikidat [done] + ** don't need it at build time, but must create it [done]... +* [done] data is (allegedly) rcs-locked by nobody; fix this in release version? +* [done] .ex files still exist +* [removed in rules] /var/www/twiki/data/.htpasswd has entries +* [not removed in rules] debug.txt ships in data -- referenced in .config, keep it? +* [moved to /var/lib per fsh] twiki/data, twiki/templates should not be browsable [so not under /var/www?] +* get topurl from debconf +* webmaster defaults to webmaster@your.company + ** use debconf? set from mailname, or apache? + ** apache just uses apacheconfig which egreps ServerAdmin from httpd.conf + +* doesn't need fileutils, grep dependency, it is Essential --- twiki-4.0.5.orig/debian/postinst +++ twiki-4.0.5/debian/postinst @@ -0,0 +1,199 @@ +#! /bin/sh +# postinst script for twiki +# +# see: dh_installdeb(1) + +# not www-data. remember to sync with rules. +TWIKI_OWNER=www-data + +set -e +# Source debconf library. +. /usr/share/debconf/confmodule + + +# summary of how this script can be called: +# * `configure' +# * `abort-upgrade' +# * `abort-remove' `in-favour' +# +# * `abort-deconfigure' `in-favour' +# `removing' +# +# for details, see /usr/share/doc/packaging-manual/ +# +# quoting from the policy: +# Any necessary prompting should almost always be confined to the +# post-installation script, and should be protected with a conditional +# so that unnecessary prompting doesn't happen if a package's +# installation fails and the `postinst' is called with `abort-upgrade', +# `abort-remove' or `abort-deconfigure'. + + +db_get twiki/samplefiles +if [ "$RET" = true ]; then +#check for the existance of _any_ of the default webs +#TODO: later this will be replaced by the upgrade script + if [ ! -e /var/lib/twiki/data/Main/WebHome.txt ]; then + if [ ! -e /var/lib/twiki/data/TWiki/WebHome.txt ]; then + if [ ! -e /var/lib/twiki/data/Sandbox/WebHome.txt ]; then + if [ ! -e /var/lib/twiki/data/Trash/WebHome.txt ]; then + if [ ! -e /var/lib/twiki/data/_default/WebHome.txt ]; then + # only extract if they say so and there's no home there + # and even then, fail on overwrite so we don't stomp. + tar -zxk -C / -f /usr/share/twiki/twiki-data.tar.gz + # clean up the .mailnotify timestamps. + webs="Main Sandbox TWiki Trash _default"; + for web in $webs; do + date +%s > /var/lib/twiki/data/$web/.mailnotify + done + if [ ! -e /var/www/twiki/pub/wikiHome.gif ]; then + tar -zxk -C / -f /usr/share/twiki/twiki-pub.tar.gz + fi + fi + fi + fi + fi + fi +fi + +db_get twiki/defaultUrlHost +# be more robust later: +perl -pi~ -e '$U=q{'"$RET"'}; s{http://your.domain.com}{$U}g;' /etc/twiki/LocalSite.cfg +perl -pi~ -e '$U=q{'"$RET"'}; s{http://your.domain.com}{$U}g;' /etc/twiki/apache.conf +#remove the double //cgi-bin caused by putting a / at the end of the hostUrl +perl -pi~ -e 's{/(/cgi-bin)}{$1}g;' /etc/twiki/apache.conf +#perl -pi~ -e '$U=q{'"$RET"'}; s{^(Redirect\s+/twiki/index.html\s+).*(cgi-bin/twiki/view\n)$}{$1$U$2};' /etc/twiki/apache.conf +rm /etc/twiki/*~ + +db_get twiki/wikiwebmaster +# do rcs checkout first? +#TODO: these settings should move to Main.TWikiPreferences +perl -pi~ -e '$U=q{'"$RET"'}; s/^(.*\*\s*Set\s*WIKIWEBMASTER\s*=\s*).*(\r?\n)$/\1$U\2/;' /var/lib/twiki/data/TWiki/TWikiPreferences.txt + +#force default to use sendmail by setting SMTPMAILHOST to blank +perl -pi~ -e 's/^(\s*\*\s*Set\s*SMTPMAILHOST\s*=\s*).*(\r\n)$/$1$2/;' /var/lib/twiki/data/TWiki/TWikiPreferences.txt + + +# prevent further confusion: done with debconfig + +# regrettably, this doesn't actually permit us to do further I/O. +# Rewrite this in perl, if we ever find a non-kerberos example of how +# to do so. + +db_stop + +case "$1" in + configure) +# P=/usr/lib/cgi-bin/twiki +# for i in attach changes edit geturl installpasswd mailnotify oops passwd preview rdiff register rename save search statistics testenv upload view viewfile; do +# if ! dpkg-statoverride --list $P/$i >/dev/null; then +# dpkg-statoverride --update --add $TWIKI_OWNER www-data 4555 $P/$i +# fi +# done + + servers="apache apache-perl apache-ssl apache2" + for server in $servers; do + if [ -e /etc/$server/conf.d ]; then + includefile=/etc/twiki/apache.conf + if [ -e /etc/$server/conf.d/twiki.conf ]; then + rm -f /etc/twiki/$server-conf.d-twiki.conf_old + mv /etc/$server/conf.d/twiki.conf /etc/twiki/$server-conf.d-twiki.conf_old + fi + ln -s $includefile /etc/$server/conf.d/twiki.conf + fi + done + + #add apache2 cgi + if [ -e /etc/apache2/mods-available/cgi.load ]; then + if [ ! -e /etc/apache2/mods-enabled/cgi.load ]; then + ln -s /etc/apache2/mods-available/cgi.load /etc/apache2/mods-enabled/cgi.load + fi + fi + + # create initial htpasswd, if needed + if [ -e /var/lib/twiki/data ]; then + #for now prefer apache 1 config, I don't know how to detect which one is prefered + if [ -e /usr/bin/htpasswd2 ]; then + HTPASSWDCMD="/usr/bin/htpasswd2"; + fi + if [ -e /usr/bin/htpasswd ]; then + HTPASSWDCMD="/usr/bin/htpasswd"; + fi + if [ -e $HTPASSWDCMD ]; then + #if the user has installed without initial universe then we can't do this + if [ ! -e /var/lib/twiki/data/.htpasswd ]; then + touch /var/lib/twiki/data/.htpasswd + $HTPASSWDCMD -b /var/lib/twiki/data/.htpasswd TWikiGuest guest + chown $TWIKI_OWNER.www-data /var/lib/twiki/data/.htpasswd + chmod 664 /var/lib/twiki/data/.htpasswd + fi + fi + fi + + if [ ! -e /usr/share/perl5/TWiki.cfg ]; then + ln -s /etc/twiki/TWiki.cfg /usr/share/perl5/TWiki.cfg + fi + + #remove the .htaccess file - moved to apache-twiki.conf + if [ -e /usr/lib/cgi-bin/twiki/.htaccess ]; then + rm /usr/lib/cgi-bin/twiki/.htaccess + fi + if [ -e /etc/twiki/.htaccess ]; then + rm /etc/twiki/.htaccess + fi + + #create securer-twiki session dir + if [ ! -e /tmp/twiki ]; then + mkdir /tmp/twiki + fi + #mmmm, mailnotify etc may be running _not_ as www-data + #and for some reason create a session + chmod 777 /tmp/twiki + chown $TWIKI_OWNER.www-data /tmp/twiki + + #add softlinks to make adding plugins easier () + if [ ! -e /var/lib/twiki/lib ]; then + ln -s /usr/share/perl5 /var/lib/twiki/lib + fi + if [ ! -e /var/lib/twiki/pub ]; then + ln -s /var/www/twiki/pub /var/lib/twiki/pub + fi + if [ ! -e /var/lib/twiki/bin ]; then + ln -s /usr/lib/cgi-bin/twiki/ /var/lib/twiki/bin + fi + if [ ! -e /var/lib/twiki/log ]; then + ln -s /var/log/twiki /var/lib/twiki/log + fi + + chown -R $TWIKI_OWNER.www-data /var/log/twiki + chmod -R 755 /var/log/twiki + chown $TWIKI_OWNER.www-data /etc/twiki/LocalSite.cfg + + # reload apache configs + for server in $servers; do + if [ -e /etc/init.d/$server ]; then + if which invoke-rc.d >/dev/null 2>&1; then + invoke-rc.d $server reload + else + /etc/init.d/$server reload + fi + fi + done + ;; + + abort-upgrade|abort-remove|abort-deconfigure) + + ;; + + *) + echo "postinst called with unknown argument \`$1'" >&2 + exit 1 + ;; +esac + +# dh_installdeb will replace this with shell code automatically +# generated by other debhelper scripts. + +#DEBHELPER# + +exit 0 --- twiki-4.0.5.orig/debian/postrm +++ twiki-4.0.5/debian/postrm @@ -0,0 +1,58 @@ +#! /bin/sh +# postrm script for twiki +# +# see: dh_installdeb(1) + +set -e + +# summary of how this script can be called: +# * `remove' +# * `purge' +# * `upgrade' +# * `failed-upgrade' +# * `abort-install' +# * `abort-install' +# * `abort-upgrade' +# * `disappear' overwrit>r> +# for details, see /usr/share/doc/packaging-manual/ + +#TODO: +# need to remove log files on purge (why doesn't lintian check for this?) +# check that all files are removed ... +if [ "$1" = "remove" ]; then + #purge|remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear) + + servers="apache apache-perl apache-ssl apache2" + for server in $servers; do + if [ -e /etc/$server/conf.d/twiki.conf ]; then + rm /etc/$server/conf.d/twiki.conf + fi + done + + # reload apache configs + for server in $servers; do + if [ -e /etc/init.d/$server ]; then + if which invoke-rc.d >/dev/null 2>&1; then + invoke-rc.d $server reload + else + /etc/init.d/$server reload + fi + fi + done +fi + +if [ "$1" = "purge" ]; then + #purge|remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear) + + files="/etc/twiki/*_old /usr/lib/cgi-bin/twiki/.htaccess* /var/log/twiki/*" + for file in $files; do + rm -f $file + done +fi + +# dh_installdeb will replace this with shell code automatically +# generated by other debhelper scripts. + +#DEBHELPER# + + --- twiki-4.0.5.orig/debian/preinst +++ twiki-4.0.5/debian/preinst @@ -0,0 +1,39 @@ +#! /bin/sh +# preinst script for twiki +# +# see: dh_installdeb(1) + +set -e + +# summary of how this script can be called: +# * `install' +# * `install' +# * `upgrade' +# * `abort-upgrade' +# +# for details, see http://www.debian.org/doc/debian-policy/ or +# the debian-policy package + + +case "$1" in + install|upgrade) +# if ! id -u twikidat >/dev/null 2>&1; then +# adduser --quiet --no-create-home --disabled-password --system --shell /bin/sh --home /var/lib/twiki twikidat +# fi + ;; + abort-upgrade) + ;; + + *) + echo "preinst called with unknown argument \`$1'" >&2 + exit 1 + ;; +esac +# dh_installdeb will replace this with shell code automatically +# generated by other debhelper scripts. + +#DEBHELPER# + +exit 0 + + --- twiki-4.0.5.orig/debian/conffile +++ twiki-4.0.5/debian/conffile @@ -0,0 +1,3 @@ +/etc/twiki/TWiki.cfg +/etc/twiki/LocalLib.cfg +/etc/twiki/apache.conf --- twiki-4.0.5.orig/debian/changelog +++ twiki-4.0.5/debian/changelog @@ -0,0 +1,338 @@ +twiki (1:4.0.5-9) unstable; urgency=emergency + + * move cgi-bin/.htaccess to apache.conf and remove // from end of defaultsiteurl + (Closes #408380) + * add liburi-perl dependancy for MailerContrib (Closes #408748) + * add libhtml-parser-perl for WysiwygPlugin (Closes #408748) + * secure the session files, and use file time to expire them + Arbitrary code execution in session files (CVE-2007-0669) (Closes #410256) + * update index.html to 4.0.5 version + * updated Czech (cs.po) translation (Closes #408659) + * moved twiki-pub.tar.gz to /usr/share/twiki (Closes #410803) + * changed samplefiles prompt to remove yes/no assumption + * unpatch on clean + + -- Sven Dowideit Sun, 11 Feb 2007 22:32:36 +0100 + +twiki (1:4.0.5-8) unstable; urgency=medium + + * make patch for #404222 allow trailing slashes again + * enable FormFields containing Name + (Closes: #405571). + + -- Sven Dowideit Wed, 10 Jan 2007 22:32:36 +0100 + +twiki (1:4.0.5-7) unstable; urgency=medium + + * Add a more useful error message in debian/patches/01_redirect_fix.dpatch + when fixing #404222, to prevent redirect to other hosts (phishing). + (Closes: #405083). Urgency medium, because it makes twiki almost unusable. + Also, the $TWiki::cfg{DefaultUrlHost} in /etc/twiki/LocalSite.cfg must not + have a trailing slash, which was no problem before. + Thanks to Kai Pastor Kai" and Marcus C. Gottwald + . + + -- Amaya Rodrigo Sastre Tue, 2 Jan 2007 12:17:36 +0100 + +twiki (1:4.0.5-6) unstable; urgency=high + + [ Sven Dowideit ] + * made dependancy on apache-common | apache2-common | apache2.2-common + (Closes: #400212, #403464). + * French debconf translation update - thankyou Michel Grentzinger + (Closes: #403532) + * prevent redirect code from allowing redirect to other hosts + (Closes: #404222) + + [ Amaya Rodrigo Sastre ] + * Added a Build-Depend on dpatch. + + -- Amaya Rodrigo Sastre Fri, 22 Dec 2006 17:42:12 +0100 + +twiki (1:4.0.5-5) unstable; urgency=low + + * fix prerm and postrm's + (Closes: #402817). + + -- Sven Dowideit Thu, 14 Dec 2006 22:32:36 +0100 + +twiki (1:4.0.5-4) unstable; urgency=low + + * Patch for debian/postinstall by Paul Szabo + (Closes: #401769). + + -- Amaya Rodrigo Sastre Tue, 5 Dec 2006 22:32:36 +0100 + +twiki (1:4.0.5-3) unstable; urgency=low + + * Correctly fix #400212 by closing the right bug number instead of #40212. + (Closes: #400212). + + -- Amaya Rodrigo Sastre Tue, 5 Dec 2006 08:35:50 +0100 + +twiki (1:4.0.5-2) unstable; urgency=high + + [ Sven Dowideit ] + * add tools scripts to /var/lib/twiki/tools (Closes: #400226) + * fix apache.conf setup to backup in the /etc/twiki dir (Closes: #333679, #400213) + * add dependancy on apache2.2-common (Closes: #40212) + * added default .mailnotify files to stop sending out change + emails for distributed topics (Closes: #211237) + + [ Amaya Rodrigo Sastre ] + * mv DH_COMPAT to debian/compat. Upgrade to 5 + * cleaned debian/rules slightly + * urgency=high because of added hotfix for security problem CVE-2006-6071 + TWiki Authentication Bypass Vulnerabilityin NEWS.Debian (Closes:#401303). + * Accepted patch from Olivier Berger for + debian/apache.conf, preventing that accessing wiki with .../twiki/ URL + pub contents are displayed (Closes: #400977). + * Add myself to the Uploaders: field so that I can hep more effectively. + * tools/mailnotify is now installed at /var/lib/twiki/tools/mailnotify + (Closes: #400226). + * Now explicitly depend on apache-common (Closes: #400212). + + -- Amaya Rodrigo Sastre Sun, 3 Dec 2006 12:19:17 +0100 + +twiki (1:4.0.5-1) unstable; urgency=high + + * update to twiki release 4.0.5 (Closes: #324916, #307299, #308347) + * following work by Amaya Rodrigo Sastre - Thankyou :) + * Build-Depend on tardy instead of the soon to be removed tarcust (Closes: #390748). + * Unfuzzy debian/po translations, thanks to Bubulle for guidance. Tampered a + bit with the pt_BR translation to unfuzzy it for real. My excuses for my + poor Brazilian skills :) + * Relate Hotfix 4 with #389267 in changelog for completeness. + * Add debconf-updatepo to the debian/rules clean target + + -- Sven Dowideit Fri, 10 Nov 2006 09:52:09 +0100 + +twiki (1:4.0.4-3) unstable; urgency=high + + * added Hotfix 4 for TWiki 4.0.4 (Closes: #389267). + + -- Sven Dowideit Fri, 15 Sep 2006 00:00:01 -1000 + +twiki (1:4.0.4-2) unstable; urgency=high + + * added Hotfix 3 for TWiki 4.0.4 + includes: + Item 2714 - SECURITY ISSUE! - Topics with ALLOWTOPICVIEW + defined in "Edit Settings" (META) can be read by anyone + with a specially crafted SEARCH. + Item 2806 - Security Alert CVE-2006-4294 - viewfile doesn't + follow rules for mapping attachment names + + -- Sven Dowideit Sat, 09 Sep 2006 00:00:01 -1000 + +twiki (1:4.0.4-1) unstable; urgency=high + + * added Hotfix 2 for TWiki 4.0.4 + includes (CVE-2006-3819) - Configure robustness update + + -- Sven Dowideit Sun, 20 Aug 2006 00:00:01 -1000 + +twiki (1:4.0.4-0.1) unstable; urgency=high + + * new upstream version TWiki-4.0.4 + includes prevent script execution of uploaded files (CVE-2006-3336) + (Closes: #381907) + 4.0.2 includes CVE-2006-1387: DoS with INCLUDE + (Closes: #367973) + * restricted access to configure script + * added libcgi-session-perl dependency + * stopped failure when /etc/apache-foo/conf.d/twiki.conf_old doesn't + exist + * cleaned up handling of apache reload/restart calls + + -- Andrew Moise Fri, 11 Aug 2006 15:05:06 -0400 + +twiki (1:4.0.1-1) unstable; urgency=high + + * new upstream version TWiki-4.0.1 + (Closes: #255782, #221514, #338118, #311662, #305793, #345668) + * added brute force restart of apache & apache2 (Closes: #300601) + * fixed regex that was supposed to set WIKIWEBMASTER (Closes: #305034) + * removed data dir from apache.conf (Closes #307928) + * added debconf-2.0 dependancy (Closes: #332129) + * improved RedirectMatch (Closes: #293369) + * updated Czech translation of debconf (Closes: #321818) + * added Vietnamese translation of debconf (Closes: #322398) + * added Swedish translation of debconf (Closes: #341095) + * fixed up debconf spelling mistake (Closes: #322399) + * added dependancy option of apache-perl (Closes: #235603) + * cleaned up index.html (Closes: #228748) + * added extra test for existing data (Closes: #229036) + * added primitive test and use of htpasswd2 for apache2 (Closes: #233943) + * remove use of wwwconfig (Closes: 251340) + + -- Sven Dowideit Sun, 26 Feb 2006 00:00:01 -1000 + +twiki (20040902-3) unstable; urgency=high + * update to include Paul Wise's RC fix + + -- Sven Dowideit Mon, 11 Apr 2005 00:00:01 -1000 + +twiki (20040902-2) unstable; urgency=high + * set twikiLibPath to /usr/share/perl5 in setlib.cfg (Closes: #296461) + * applied robustness patch from Florian Weimer + CAN-2005-2877 - (Closes: #296655) + * added libunicode-maputf8-perl suggestion (Closes: #297031) + * default to use sendmail (Closes: #252439) + * updated fr.po file (Closes: #296149, #298750) + + -- Sven Dowideit Sun, 10 Mar 2005 00:00:01 -1000 + +twiki (20040902-1.1) unstable; urgency=medium + + * Non-maintainer upload. + * Urgency medium due to RC fix. + * Remove Text/Diff.pm and Algorithm/Diff.pm in debian/rules (Closes: #295221) + + -- Paul Wise Wed, 6 Apr 2005 23:56:57 +0800 + +twiki (20040902-1) unstable; urgency=high + * upgraded to 02-Sept-2004 release (Cairo) + (Closes :#270143, #283517, #281597) + * don't allow view on topics with empty ALLOW pref (Closes: #281624) + * applied ViewAfterSaveCachesOldPage-ugly-fix.patch (Closes: #218922) + - maybe!! (I could never re-produce it) + * corrected the permssions of log and .htpasswd (Closes: #281761) + * added another test to reduce the chance of over-writing an existing + universe (Closes: #282947) + * moved postinst backup files (~) to /tmp (Closes: #283812) + * postinst can now deal with remnant apache.conf files (Closes: #282006) + * added Czech translation of debconf messages - Thanks to Miroslav Kure + (Closes: #287432) + * added Brazilian Portuguese translation of debconf messages + Thanks to Tiago Bortoletto Vaz (Closes: #267513) + + -- Sven Dowideit Sun, 16 Nov 2004 00:00:01 -1000 + +twiki (20030201-6) unstable; urgency=emergency + + * patched security vunerability in Search (Closes: #281005) + * removed apachectl restart as it fails in postrm (Closes: #276058) + * enable apache2 cgi using symlink (Closes: #266873) + + -- Sven Dowideit Sat, 13 Nov 2004 00:00:01 -1000 + +twiki (20030201-5) unstable; urgency=low + + * added dependancy option of apache-perl (Closes: #235603) + * cleaned up index.html (Closes: #228748) + * added extra test for existing data (Closes: #229036) + * added primitive test and use of htpasswd2 for apache2 (Closes: #233943) + * added upstream patch ProxiedIncludesBrokenImplementationBug + - (Closes: #255782) + * made TWikiRegistrationPub the default to match .htaccess default + - (Closes: #221514) + * remove use of wwwconfig (Closes: 251340) + + -- Sven Dowideit Sun, 27 Jun 2004 00:00:01 -1000 + +twiki (20030201-4) unstable; urgency=high + + * added .htaccess to conffile (Closes: #217406) + * fixed up doc-base file (Closes: #215395) + * moved change of index.html from postinst to rules (Closes: #215397) + * updated copyright + * created viewauth by copying view (Closes: #228061) + * added upstream patch for ExtraneousLineInHttpHeader + * added upstream patch for InsecureViewWithFailedAuthentication + * added upstream patch for NoShellCharacterEscapingInFileAttachComment + * added upstream patch for SecurityAlertGainAdminRightWithTWikiUsersMapping + + -- Sven Dowideit Sat, 17 Jan 2004 00:00:01 -1000 + +twiki (20030201-3) unstable; urgency=low + + * fixed up index.html path in postinst (Closes: #211166) + * added softlinks in /var/lib/twiki to re-produce upstream filesystem + - (Closes: #210898) + * set .mailnotify timestamp on example universe install + - part of #211237 suggestion + + -- Sven Dowideit Sun, 1 Oct 2003 00:00:01 -1000 + +twiki (20030201-2) unstable; urgency=low + + * applied some patches from upstream + - Codev.AlternateWebPrefsBug: Incorrect init of alternate web + preferences (Closes: #194783) + - Support.TWikiWebCantBeProtected: removed special case for TWiki + and Main Webs (Closes: #202314) + - unsafe grep options fixed upstream (Closes: #152515) + * upstream release fixed META suffix macro (Closes: #152516) + * I'm fixing the bugs, don't need to orphan (Closes: #186428) + * should have closed this last time: new release of TWiki, apache-ssl + (Closes: #194356) + * apache-ssl works (from previous release) (Closes: #169433) + * added debconf note about Registration and creation of apache users + - (Closes: #171429, #152497, #163344) + + -- Sven Dowideit Sun, 14 Sep 2003 00:00:01 -1000 + +twiki (20030201-1) unstable; urgency=low + + * Changed Maintainership - Mark W. Eichin has no time + * upgrade to 01Feb2003 release (Bejing) (Closes: #192718) + * removed the use of twikidat user for now, + - it causes problems with uploads of attachments and topic edits + - (Closes: #163514, #165340, #171441, #153430) + * removed the Alias /twiki line in apache.conf + - (Closes: #151187, #190409) + * fixed postrm script (Closes: #171421) + * added TWikiOnDebian to README.Debian (Closes: #171468) + * changed the path to grep + - (Closes: #177047) + * removed perl-suid dependancy for the moment (Closes: #149319) + * added dependency for apache2 | apache | apache-ssl (Closes: #171426) + * switched to gettext for the debconf templates (Closes: #199999) + * added french translation of the debconf templates (Closes: #200575) + * seems to fix apt-get --purge remove twiki (Closes: #183917) + * this has been resolved upstream (Closes: #151188) + * this has been resolved upstream (Closes: #153168) + * this has been resolved upstream + - http://www.twiki.org/cgi-bin/view/Codev/FormRenderForEdit + - (Closes: #152766) + * seems to be working now with perl 5.8.0 (Closes: #169791) + + -- Sven Dowideit Sun, 27 Aug 2003 00:00:01 -1000 + +twiki (20011201-2.1) unstable; urgency=low + + * Non-maintainer upload + * Fix FTBFS problem. (Closes: #163514) + - do not chown to twiki user, because it will break the building process + * debian/control: + - change Build-Depends to Build-Depends-Indep + - update standards version + * debian/copyright: + - remove (s) from Author's line + * debian/rules: + - chmod the files, to make it lintian clear. Afaik 655 doesn't make sense. + - don't install license.txt this violate to policy + + -- Thorsten Sauter Fri, 18 Jul 2003 10:11:12 +0000 + +twiki (20011201-2) unstable; urgency=low + + * One step at a time - getting the trivial ones out of the way... + * debian/postrm: ignore status of dpkg-statoverride --remove, in case + we've been run twice (Closes: #151105) + * debian/postinst: create /var/lib/twiki/data/.htpasswd if we have to + (Closes: #151186, #148805) Don't let apacheconfig hang (since there's + no way to mix apacheconfig and debconf) but lacking a sane perl debconf + example, just cheat and force apacheconfig without restarting the server. + * debian/control: bump wwwconfig-common dependency to a version that + includes it apache-include-postrm.sh. + + -- Mark W. Eichin Mon, 22 Jul 2002 00:34:51 -0400 + +twiki (20011201-1) unstable; urgency=low + + * Initial Release. (Closes: #68712, #79667) + + -- Mark W. Eichin Sun, 20 Jan 2002 10:31:23 -0500 + --- twiki-4.0.5.orig/debian/docs +++ twiki-4.0.5/debian/docs @@ -0,0 +1,6 @@ +index.html +license.txt +readme.txt +INSTALL.html +TWikiReleaseNotes04x00.html +TWikiHistory.html --- twiki-4.0.5.orig/debian/rules +++ twiki-4.0.5/debian/rules @@ -0,0 +1,166 @@ +#!/usr/bin/make -f +# Sample debian/rules that uses debhelper. +# GNU copyright 1997 to 1999 by Joey Hess. + +include /usr/share/dpatch/dpatch.make + +# Uncomment this to turn on verbose mode. +#export DH_VERBOSE=1 + +# not www-data. remember to sync with postinst. +TWIKI_OWNER=www-data + +configure: configure-stamp +configure-stamp: + dh_testdir + touch configure-stamp + +build: patch build-stamp + +build-stamp: configure-stamp + dh_testdir + touch build-stamp + +clean: + #unpatch + dh_testdir + dh_testroot + find . -name '*~' -print0 | xargs -0 rm -f + rm -f build-stamp configure-stamp + debconf-updatepo + dh_clean + +install: build + dh_testdir + dh_testroot + dh_clean -k + dh_installdirs + + cp -r bin/* debian/twiki/usr/lib/cgi-bin/twiki + cp -r debian/twiki/usr/lib/cgi-bin/twiki/LocalLib.cfg.txt debian/twiki/usr/lib/cgi-bin/twiki/LocalLib.cfg + + # not needed, with statoverride? + chmod 755 debian/twiki/usr/lib/cgi-bin/twiki/* + chmod 644 debian/twiki/usr/lib/cgi-bin/twiki/setlib.cfg + #need more libreal perms to allow configure script to work :() + chmod 644 debian/twiki/usr/lib/cgi-bin/twiki/LocalLib.cfg + chmod 644 debian/twiki/usr/lib/cgi-bin/twiki/LocalLib.cfg.txt + +# chown $(TWIKI_OWNER) debian/twiki/usr/lib/cgi-bin/twiki/* + cp -Rp pub/* debian/twiki/var/www/twiki/pub + cp -pR templates debian/twiki/var/lib/twiki/ + cp -pR locale debian/twiki/var/lib/twiki/ + cp -pR data/* debian/twiki/var/lib/twiki/data + + #create mailnotify timestamps + date +%s > debian/twiki/var/lib/twiki/data/TWiki/.mailnotify + date +%s > debian/twiki/var/lib/twiki/data/Main/.mailnotify + date +%s > debian/twiki/var/lib/twiki/data/Sandbox/.mailnotify + +# change the unix owners -- don't bother, tar --owner does it +# so now we don't even care if TWIKI_OWNER exists at build time +# chown -R $(TWIKI_OWNER) debian/twiki/var/lib/twiki/data +# and change the RCS lock owners to match + + #distribute the tools scripts + cp UpgradeTwiki debian/twiki/var/lib/twiki + chmod 777 debian/twiki/var/lib/twiki/UpgradeTwiki + + mkdir debian/twiki/var/lib/twiki/tools + cp tools/* debian/twiki/var/lib/twiki/tools/ + chmod 777 debian/twiki/var/lib/twiki/tools/* + + #SVEN - you should probably make this a patch file. + perl -piOLD -e 's{#! perl}{#!/usr/bin/perl}g;' debian/twiki/var/lib/twiki/tools/rewriteshbang.pl + perl -piOLD -e 's{#!perl}{#!/usr/bin/perl}g;' debian/twiki/var/lib/twiki/tools/upgrade_emails.pl + + rm debian/twiki/var/lib/twiki/tools/*OLD + + chmod -R 644 debian/twiki/var/lib/twiki/templates/* + + + find debian/twiki/var/lib/twiki/data -type f -name '*,v' | \ + xargs -n1 perl -pi -e 's/^(\s)nobody:/\1$(TWIKI_OWNER):/ unless $$done; $$done=1 if /^\n$$/;' + tar -cf - -C debian/twiki var/lib/twiki/data \ + | tardy -User_NAme=$(TWIKI_OWNER) -Group_NAme=www-data \ + | gzip -c -9 > debian/twiki/usr/share/twiki/twiki-data.tar.gz + rm -rf debian/twiki/var/lib/twiki/data + +#do the same with pub - it should also only be replaced if there is none there already +# and it needs to be owned by $(TWIKI_OWNER) + find debian/twiki/var/www/twiki/pub -type f -name '*,v' | \ + xargs -n1 perl -pi -e 's/^(\s)nobody:/\1$(TWIKI_OWNER):/ unless $$done; $$done=1 if /^\n$$/;' + tar -cf - -C debian/twiki var/www/twiki/pub \ + | tardy -User_NAme=$(TWIKI_OWNER) -Group_NAme=www-data \ + | gzip -c -9 > debian/twiki/usr/share/twiki/twiki-pub.tar.gz + rm -rf debian/twiki/var/www/twiki/pub + + cp -pR lib/* debian/twiki/usr/share/perl5/ + cp -p debian/apache.conf debian/twiki/etc/twiki/ + + + +# setlib.cfg + perl -pi~ -e 's|^(.twikiLibPath).*|\1 = \"/usr/share/perl5\";|;' debian/twiki/usr/lib/cgi-bin/twiki/setlib.cfg + rm debian/twiki/usr/lib/cgi-bin/twiki/setlib.cfg~ + +#move twiki.cfg to /etc/twiki + cp debian/LocalSite.cfg debian/twiki/etc/twiki/LocalSite.cfg + mv debian/twiki/usr/share/perl5/LocalSite.cfg.txt debian/twiki/etc/twiki/LocalSite.cfg.txt + mv debian/twiki/usr/share/perl5/TWiki.cfg debian/twiki/etc/twiki/TWiki.cfg + + perl -pi~ -e 's|^(.twikiLibPath).*|\1 = \"/etc/twiki\";|;' debian/twiki/usr/lib/cgi-bin/twiki/LocalLib.cfg + rm debian/twiki/usr/lib/cgi-bin/twiki/LocalLib.cfg~ + + chmod -R 644 debian/twiki/etc/twiki/* + + +# fix paths for index.html + perl -pi~ -e 's|http://your.server.com/your-cgi-bin/view/Main/WebHome|http://localhost/cgi-bin/twiki/view/Main/WebHome|;' index.html + perl -pi~ -e 's|license.txt|copyright|g;' index.html + rm index.html~ + +# Build architecture-independent files here. +binary-indep: build install +# We have nothing to do by default. + +# Build architecture-dependent files here. +binary-arch: build install + dh_testdir + dh_testroot + dh_installdebconf + dh_installdocs -Xlicense.txt + dh_installexamples + dh_installmenu +# dh_installlogrotate +# dh_installemacsen +# dh_installpam +# dh_installmime +# dh_installinit + dh_installcron + dh_installman + dh_installinfo +# dh_undocumented + dh_installchangelogs + dh_link + dh_strip + dh_compress + dh_fixperms # --exclude /var/www/twiki/data +# dh_makeshlibs + dh_installdeb + dh_perl +# dh_shlibdeps + dh_gencontrol + dh_md5sums + dh_builddeb + +# maintainer targets +#checkpo: +# for i in po/*.po; do \ +# echo \"Checking: $$i\"; \ +# msgmerge -U $$i po/templates.pot; \ +# msgfmt -o /dev/null -c --statistics $$i; \ +# done + +binary: binary-indep binary-arch +.PHONY: build clean binary-indep binary-arch binary install configure --- twiki-4.0.5.orig/debian/templates +++ twiki-4.0.5/debian/templates @@ -0,0 +1,34 @@ +Template: twiki/defaultUrlHost +Type: string +_Default: http://localhost/ +_Description: What is the top-level URL of the server TWiki runs under? + For a normal install, this should be a URL for your web server's full + name, which is used to construct urls on some pages. The install will + serve up the data by adding "twiki" to the end of this setting; it is also + needed for certain redirections. + +Template: twiki/wikiwebmaster +Type: string +_Default: webmaster@localhost +_Description: What is the email address of the webmaster for this TWiki? + This email address gets mail for new user registration, and is listed on + the "oops" page when things go wrong. + +Template: twiki/samplefiles +Type: boolean +Default: true +_Description: Install default wiki Topic Set on initial install? + TWiki includes a complete "starter kit" which includes user registration + pages, documentation, and tutorials. Only decline if you're re-installing + twiki after deleting the package and want to keep the old data, or if you've got a + twiki data set from your own manual install. + If data/Main/WebHome.txt is present, the starter kit will not be unpacked. + The the starter kit files can be found in /usr/share/twiki/twiki-data.tar.gz + (and twiki-pub.tar.gz), if you want to install it manually or compare your + topics with the new version) + +Template: twiki/apacheUserCreationNote +Type: note +_Description: Admin User Registration configuration required + After you have created yourself a user, edit the Main.TWikiAdminGroup + to restrict Admin privileges to that user. --- twiki-4.0.5.orig/debian/dirs +++ twiki-4.0.5/debian/dirs @@ -0,0 +1,10 @@ +var/www/twiki/pub +var/lib/twiki/templates +var/lib/twiki/data +var/log/twiki +usr/lib/cgi-bin/twiki +usr/share/perl5 +etc/twiki +usr/share/doc/twiki +usr/share/twiki +tmp/twiki --- twiki-4.0.5.orig/debian/config +++ twiki-4.0.5/debian/config @@ -0,0 +1,16 @@ +#!/bin/sh +set -e + +# Source debconf library. +. /usr/share/debconf/confmodule + +# What is the top-level URL of the server TWiki runs under? +# high = Items that don't have a reasonable default +# unless we preload it with mailname... +db_input high twiki/defaultUrlHost || true +db_input high twiki/wikiwebmaster || true +# medium = Normal items that have reasonable defaults. +db_input medium twiki/samplefiles || true +# add info due to 3-4 bug reports +db_input high twiki/apacheUserCreationNote || true +db_go || true --- twiki-4.0.5.orig/debian/apache.conf +++ twiki-4.0.5/debian/apache.conf @@ -0,0 +1,40 @@ +# Added for twiki +Alias /twiki/pub /var/www/twiki/pub + +RedirectMatch /twiki(/([A-Z].*)?)?$ http://your.domain.com/cgi-bin/twiki/view$1 + +# make sure this is even needed, and ref the doc section needing it + + BrowserMatchNoCase ^$ anonymous_spider + + # Now set default access rights. + Order Allow,Deny + Allow from all + Deny from env=anonymous_spider + + # Authentication type (htpasswd file) (comment out this if you configure htpasswd / LDAP support) + AuthUserFile /var/lib/twiki/data/.htpasswd + AuthName 'Enter your WikiName: (First name and last name, no space, no dots, capitalized, e.g. JohnSmith). Cancel to register if you do not have one.' + AuthType Basic + + ErrorDocument 401 /cgi-bin/twiki/view/TWiki/TWikiRegistration + + Options +ExecCGI +FollowSymLinks + SetHandler cgi-script + AllowOverride all + Allow from all + + + Order Deny,Allow + Deny from all + Allow from 127.0.0.1, 192.168.1.10 + Require user TWikiGuest + Satisfy Any + + + + require valid-user + + + +# End twiki Configuration Block --- twiki-4.0.5.orig/debian/copyright +++ twiki-4.0.5/debian/copyright @@ -0,0 +1,53 @@ +This package was debianized by Mark W. Eichin on +Sun, 20 Jan 2002 10:31:23 -0500. +it has since been updated by Sven Dowideit + + +It was downloaded from http://TWiki.org/TWiki20030201.zip +(but please go through the survey form http://TWiki.org/download.html +to help the upstream authors get data on usage.) + +Upstream Author: Peter Thoeny + +Copyright: (from license.txt) + +Copyright and License of TWiki, 18 Dec 2003 +------------------------------------------- + +TWiki (TM) is copyrighted (C) 1999-2003 by Peter Thoeny, +Peter@Thoeny.com; ALL RIGHTS RESERVED. TWiki's core +team and other contributors also hold copyrights. See +list of contributors at +http://TWiki.org/cgi-bin/view/TWiki/TWikiContributor + +TWiki is open source software; you can redistribute it +and/or modify it under the terms of the GNU General Public +License as published by the Free Software Foundation; +either version 2 of the License, or (at your option) any +later version. We would appreciate if redistributions of +TWiki and its clones retain this license.txt file in its +entire form, thus acknowledging the origin of TWiki and +the thousands of hours the core team and contributors put +into creating this product. + +This program is distributed in the hope that it will be +useful, but WITHOUT ANY WARRANTY; without even the implied +warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +PURPOSE. See the GNU General Public License for more +details, for your convenience attached below, also +published at http://www.gnu.org/copyleft/gpl.html + +Please note that TWiki is NOT distributed under the LGPL +(Lesser General Public Licence), which implies TWiki can +only be used with software that is licensed under conditions +compliant with the GPL. Embedding in proprietary software +requires an alternative license. Contact the author for +details. + +-- +Peter Thoeny, Peter@Thoeny.com, http://TWiki.org/ + + +On Debian GNU/Linux systems, the complete text of the GNU General +Public License can be found in `/usr/share/common-licenses/GPL'. + --- twiki-4.0.5.orig/debian/index.html +++ twiki-4.0.5/debian/index.html @@ -0,0 +1,1828 @@ + + + + Welcome to TWiki - A Web-based Collaboration Platform + + + +
+

Welcome to TWiki

+ +

Note: These pages do not need to be accessible by browsers. Preventing access will increase security and will not affect TWiki in any way.

+
+
 
+
+ + --- twiki-4.0.5.orig/debian/doc-base +++ twiki-4.0.5/debian/doc-base @@ -0,0 +1,14 @@ +Document: twiki +Title: Debian twiki Manual +Author: Peter Thoeny +Abstract: This manual describes the TWiki web-based collaboration system. +Section: web + +Format: HTML +Index: /usr/share/doc/twiki/index.html +Files: /usr/share/doc/twiki/*.html + +Format: Text +Files: /usr/share/doc/twiki/readme.txt + + --- twiki-4.0.5.orig/debian/README.Debian +++ twiki-4.0.5/debian/README.Debian @@ -0,0 +1,100 @@ +TWiki for Debian +---------------- + +/usr/share/twiki/twiki-data.tar.gz has the initial data set, if +you find you want to restore the data in /var/lib/twiki/data/ after +experimenting. +/usr/share/twiki/twiki-pub.tar.gz has the initial pub data set. +It should also be unpacked to /var/www/twiki/pub + + +For multiple TWiki's on the same machine, it is recommended that you +just have multiple data sets on one TWiki. If you really need more +than one, in particular to isolate the data under a different uid, +there are a bunch of things you need to do; I can make suggestions, or +if you figure it out let me know and I'll try and integrate such +enhancements into the package. + +To report upstream issues (and feedback) please goto + http://twiki.org/cgi-bin/view/Codev/TWikiOnDebian + + -- Sven Dowideit , Sun, 03 Jan 2003 10:31:23 -1000 + + + +Security Alert: Login bypass allows view of access restricted content +(CVE-2006-6071) +http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2006-6071 + +Attack Vectors + +An unauthorized user can login by cancelling out of a failed login. + +Impact + +An unauthorized user is able to view content in access restricted topics. +Editing topics and attaching files is not impacted. + +Severity Level + +The TWiki SecurityTeam triaged this issue as documented in +TWikiSecurityAlertProcess and assigned the following severity level: + + * Severity 3 issue: TWiki content or browser is compromised + +MITRE Name for this Vulnerability + +The Common Vulnerabilities and Exposures project has assigned the name +CVE-2006-6071 to this vulnerability. + +Details + +Your site may be vulnerable if: + + 1. If you have ErrorDocument 401 set to point to the TWikiRegistration topic + (or any other TWiki topic) and + 2. You are using ApacheLogin with TWiki-4.0 and have sessions enabled, or + you are using an earlier TWiki version with SessionPlugin, and + 3. You are running Apache 1.3 + +The exploit can be used to view pages protected by TWiki permissions. It does +not allow you to to gain write access. You can verify if your site is +vulnerable as follows: + + 1. Click the 'Login' link in the left bar + 2. Enter the login name of a valid user, but an incorrect password. + 3. Click "Ok" + 4. If apache re-prompts, enter the same username and password again + 5. Click "Cancel" + +If your site is vulnerable you will be redirected to the TWikiRegistration +topic with the valid user apparently logged in (the name appears in the left +bar). + +Countermeasures + + * Restrict access to the TWiki installation. + * Apply the hotfix indicated below. + + * NOTE: The hotfix is known to prevent the current attacks, but it might not be a complete fix + +Hotfix + +Delete the ErrorDocument line in the Apache configuration (httpd.conf or +.htaccess), or (preferred) change it to point to a static HTML page. This page +can safely contain a link to the TWikiRegistration page. For example, + + +Failed login + + + +Your login attempt failed. +

+Do you want to +register in TWiki? + + + +(modify the href as appropriate for your site.) + --- twiki-4.0.5.orig/debian/LocalSite.cfg +++ twiki-4.0.5/debian/LocalSite.cfg @@ -0,0 +1,16 @@ +$TWiki::cfg{DataDir} = '/var/lib/twiki/data'; +$TWiki::cfg{LogDir} = '/var/lib/twiki/log'; +$TWiki::cfg{Site}{Lang} = 'en'; +$TWiki::cfg{LocalesDir} = '/var/lib/twiki/locale'; +$TWiki::cfg{ScriptUrlPath} = '/cgi-bin/twiki'; +$TWiki::cfg{DefaultUrlHost} = 'http://your.domain.com'; +$TWiki::cfg{Site}{FullLang} = 'en-us'; +$TWiki::cfg{PubUrlPath} = '/twiki/pub'; +$TWiki::cfg{PubDir} = '/var/www/twiki/pub'; +$TWiki::cfg{TemplateDir} = '/var/lib/twiki/templates'; +$TWiki::cfg{Sessions}{Dir} = '/tmp/twiki'; +$TWiki::cfg{PassthroughDir} = '/tmp/twiki'; +$TWiki::cfg{Site}{CharSet} = 'iso-8859-15'; +$TWiki::cfg{LoginManager} = 'TWiki::Client::ApacheLogin'; +$TWiki::cfg{Plugins}{WysiwygPlugin}{Enabled} = 1; +1; --- twiki-4.0.5.orig/debian/compat +++ twiki-4.0.5/debian/compat @@ -0,0 +1 @@ +5 --- twiki-4.0.5.orig/debian/NEWS.Debian +++ twiki-4.0.5/debian/NEWS.Debian @@ -0,0 +1,76 @@ +Security Alert: Login bypass allows view of access restricted content +(CVE-2006-6071) +http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2006-6071 + +Attack Vectors + +An unauthorized user can login by cancelling out of a failed login. + +Impact + +An unauthorized user is able to view content in access restricted topics. +Editing topics and attaching files is not impacted. + +Severity Level + +The TWiki SecurityTeam triaged this issue as documented in +TWikiSecurityAlertProcess and assigned the following severity level: + + * Severity 3 issue: TWiki content or browser is compromised + +MITRE Name for this Vulnerability + +The Common Vulnerabilities and Exposures project has assigned the name +CVE-2006-6071 to this vulnerability. + +Details + +Your site may be vulnerable if: + + 1. If you have ErrorDocument 401 set to point to the TWikiRegistration topic + (or any other TWiki topic) and + 2. You are using ApacheLogin with TWiki-4.0 and have sessions enabled, or + you are using an earlier TWiki version with SessionPlugin, and + 3. You are running Apache 1.3 + +The exploit can be used to view pages protected by TWiki permissions. It does +not allow you to to gain write access. You can verify if your site is +vulnerable as follows: + + 1. Click the 'Login' link in the left bar + 2. Enter the login name of a valid user, but an incorrect password. + 3. Click "Ok" + 4. If apache re-prompts, enter the same username and password again + 5. Click "Cancel" + +If your site is vulnerable you will be redirected to the TWikiRegistration +topic with the valid user apparently logged in (the name appears in the left +bar). + +Countermeasures + + * Restrict access to the TWiki installation. + * Apply the hotfix indicated below. + + * NOTE: The hotfix is known to prevent the current attacks, but it might not be a complete fix + +Hotfix + +Delete the ErrorDocument line in the Apache configuration (httpd.conf or +.htaccess), or (preferred) change it to point to a static HTML page. This page +can safely contain a link to the TWikiRegistration page. For example, + + +Failed login + + + +Your login attempt failed. +

+Do you want to +register in TWiki? + + + +(modify the href as appropriate for your site.) +