Compare commits

..

6 Commits

Author SHA1 Message Date
6f716134dd Fix misprint
Instead  https://github.com/ONLYOFFICE/Docker-DocumentServer/pull/579
2023-02-22 17:41:59 +05:00
4c05627d1f Merge pull request #585 from ONLYOFFICE/bugfix/psql-owner
fix Bug 59826 - Fix database creation without onlyoffice owner
2023-02-07 18:53:11 +05:00
985bc4020a Fix database creation without onlyoffice owner 2023-02-07 16:08:40 +03:00
46215d4372 Merge pull request #584 from ONLYOFFICE/hotfix/v7.3.2
Merger hotfix/v7.3.2 into hotfix/v7.3.3
2023-02-07 13:02:08 +05:00
83825d26e9 Generated JWT secret is too small for HMAC SHA256 (#582)
The key that is automatically generated weaken the security strength.
As noted in RFC7518 section 3.2 [0]:
```
A key of the same size as the hash output (for instance, 256 bits for
"HS256") or larger MUST be used with this algorithm.  (This
requirement is based on Section 5.3.4 (Security Effect of the HMAC
Key) of NIST SP 800-117 [NIST.800-107], which states that the
effective security strength is the minimum of the security strength
of the key and two times the size of the internal hash value.)
```

Some JWT libraries are rejecting by default keys that are too small in
a attempt to prevent misusages so generating a key that does not respect
the minimal length can be problematic for OO integrations.

[0] https://www.rfc-editor.org/rfc/rfc7518.html#section-3.2
2023-02-07 11:02:40 +05:00
cac79dea01 Install rabbitmq-server from default ubuntu repo, fixed bug closes #575 (#578) 2023-02-02 20:41:49 +05:00
6 changed files with 37 additions and 10 deletions

View File

@ -124,8 +124,8 @@ jobs:
BUILD_NUMBER=${{ github.event.inputs.build }}
export PRODUCT_EDITION
export PACKAGE_VERSION=${PRODUCT_VERSION}-${BUILD_NUMBER}
export PACKAGE_BASEURL=${{ secrets.REPO_BASEURL }}
export PACKAGE_VERSION=${PRODUCT_VERSION}-${BUILD_NUMBER}~stretch
export PACKAGE_BASEURL=${{ secrets.REPO_BASEURL }}/${BUILD_CHANNEL}
export BUILD_CHANNEL
export PLATFORM
export DOCKERFILE=Dockerfile

View File

@ -114,11 +114,11 @@ jobs:
run: |
set -eux
export PRODUCT_EDITION=${{ matrix.edition }}
export PACKAGE_BASEURL=${{ secrets.REPO_BASEURL }}
export PACKAGE_BASEURL=${{ secrets.REPO_BASEURL }}/test
export DOCKERFILE=Dockerfile
export BASE_IMAGE=ubuntu:20.04
export PG_VERSION=12
export TAG=${{ github.event.inputs.tag }}
export PACKAGE_VERSION=$( echo ${TAG} | sed -E 's/(.*)\./\1-/')
export PACKAGE_VERSION=$( echo ${TAG} | sed -E 's/(.*)\./\1-/')~stretch
docker buildx bake -f docker-bake.hcl documentserver-ucs --push
shell: bash

View File

@ -9,8 +9,6 @@ ENV LANG=en_US.UTF-8 LANGUAGE=en_US:en LC_ALL=en_US.UTF-8 DEBIAN_FRONTEND=nonint
ARG ONLYOFFICE_VALUE=onlyoffice
SHELL ["/bin/sh", "-x", "-c"]
RUN echo "#!/bin/sh\nexit 0" > /usr/sbin/policy-rc.d && \
apt-get -y update && \
apt-get -yq install wget apt-transport-https gnupg locales lsb-release && \

View File

@ -12,7 +12,7 @@ COMPANY_NAME_ESC = $(subst -,,$(COMPANY_NAME_LOW))
PACKAGE_NAME := $(COMPANY_NAME_LOW)-$(PRODUCT_NAME)$(PRODUCT_EDITION)
PACKAGE_VERSION ?= $(PRODUCT_VERSION)-$(BUILD_NUMBER)~stretch
PACKAGE_BASEURL ?= https://s3.eu-west-1.amazonaws.com/repo-doc-onlyoffice-com/server/linux/debian
PACKAGE_BASEURL ?= https://s3.eu-west-1.amazonaws.com/repo-doc-onlyoffice-com/server/linux/debian/$(BUILD_CHANNEL)
ifeq ($(BUILD_CHANNEL),$(filter $(BUILD_CHANNEL),nightly test))
DOCKER_TAG := $(PRODUCT_VERSION).$(BUILD_NUMBER)

View File

@ -0,0 +1,27 @@
; supervisor config file
[inet_http_server]
port = 127.0.0.1:9001
[supervisord]
logfile=/var/log/supervisor/supervisord.log ; (main log file;default $CWD/supervisord.log)
pidfile=/var/run/supervisord.pid ; (supervisord pidfile;default supervisord.pid)
childlogdir=/var/log/supervisor ; ('AUTO' child log dir, default $TEMP)
; the below section must remain in the config file for RPC
; (supervisorctl/web interface) to work, additional interfaces may be
; added by defining them in separate rpcinterface: sections
[rpcinterface:supervisor]
supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
[supervisorctl]
serverurl = http://localhost:9001 ; use a unix:// URL for a unix socket
; The [include] section can just contain the "files" setting. This
; setting can list multiple files (separated by whitespace or
; newlines). It can also contain wildcards. The filenames are
; interpreted as relative to this file. Included files *cannot*
; include files themselves.
[include]
files = /etc/supervisor/conf.d/*.conf

View File

@ -87,7 +87,7 @@ fi
[ -z $JWT_SECRET ] && JWT_MESSAGE='JWT is enabled by default. A random secret is generated automatically. Run the command "docker exec $(sudo docker ps -q) sudo documentserver-jwt-status.sh" to get information about JWT.'
JWT_SECRET=${JWT_SECRET:-$(pwgen -s 20)}
JWT_SECRET=${JWT_SECRET:-$(pwgen -s 32)}
JWT_HEADER=${JWT_HEADER:-Authorization}
JWT_IN_BODY=${JWT_IN_BODY:-false}
@ -494,8 +494,10 @@ update_nginx_settings(){
update_supervisor_settings(){
# Copy modified supervisor start script
cp ${SYSCONF_TEMPLATES_DIR}/supervisor/supervisor /etc/init.d/
# Copy modified supervisor config
cp ${SYSCONF_TEMPLATES_DIR}/supervisor/supervisord.conf /etc/supervisor/supervisord.conf
sed "s/COMPANY_NAME/${COMPANY_NAME}/g" -i ${SYSCONF_TEMPLATES_DIR}/supervisor/ds/*.conf
cp ${SYSCONF_TEMPLATES_DIR}/supervisor/ds/*.conf etc/supervisor/conf.d/
cp ${SYSCONF_TEMPLATES_DIR}/supervisor/ds/*.conf /etc/supervisor/conf.d/
}
update_log_settings(){
@ -598,7 +600,7 @@ else
update_welcome_page
fi
find /etc/${COMPANY_NAME} ! -path '*logrotate*' -exec chown ds:ds {} \;
find /etc/${COMPANY_NAME} -exec chown ds:ds {} \;
#start needed local services
for i in ${LOCAL_SERVICES[@]}; do