notes.rst

Next release notes

Note

Those release notes refer to the current development branch and are reset after each release.

Fix Gzip compression to avoid BREACH exploit [security] [manual action required]

In the 0.18 release, we've enabled Gzip compression by default for various content types, including HTML and JSON. Unfortunately, enabling Gzip compression on such content types could make BREACH-type exploits possible.

We've removed the risky content-types from our nginx template files, to ensure new instances are safe, however, if you already have an instance, you need to double check that your host nginx virtualhost do not include the following values for the gzip_types settings:

application/atom+xml
application/json
application/ld+json
application/activity+json
application/manifest+json
application/rss+xml
application/xhtml+xml
application/xml

For convenience, you can also replace the whole setting with the following snippet:

gzip_types
   application/javascript
   application/vnd.geo+json
   application/vnd.ms-fontobject
   application/x-font-ttf
   application/x-web-app-manifest+json
   font/opentype
   image/bmp
   image/svg+xml
   image/x-icon
   text/cache-manifest
   text/css
   text/plain
   text/vcard
   text/vnd.rim.location.xloc
   text/vtt
   text/x-component
   text/x-cross-domain-policy;

Fix Apache configuration file for 0.18 [manual action required]

The way front is served has changed since 0.18. The Apache configuration can't serve 0.18 properly, leading to blank screens.

If you are on an Apache setup, you will have to replace the <Location "/api"> block with the following:

<Location "/">
   # similar to nginx 'client_max_body_size 100M;'
   LimitRequestBody 104857600

   ProxyPass ${funkwhale-api}/
   ProxyPassReverse ${funkwhale-api}/
</Location>

And add some more ProxyPass directives so that the Alias part of your configuration file looks this way:

ProxyPass "/front" "!"
Alias /front /srv/funkwhale/front/dist

ProxyPass "/media" "!"
Alias /media /srv/funkwhale/data/media

ProxyPass "/staticfiles" "!"
Alias /staticfiles /srv/funkwhale/data/static

In case you are using custom css and theming, you also need to match this block:

ProxyPass "/settings.json" "!"
Alias /settings.json /srv/funkwhale/custom/settings.json

ProxyPass "/custom" "!"
Alias /custom /srv/funkwhale/custom