diff --git a/CHANGELOG b/CHANGELOG index e5444df94d0f1a9b1c799a864ca1f173c7a10086..a0446517fe0c9596426e7d1d4e25a2b8a9cee4fa 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -10,6 +10,121 @@ This changelog is viewable on the web at https://docs.funkwhale.audio/changelog. .. towncrier +0.18.1 (2019-01-29) +------------------- + +Upgrade instructions are available at +https://docs.funkwhale.audio/index.html + + +Fix Gzip compression to avoid BREACH exploit [security] [manual action required] +-------------------------------------------------------------------------------- + +In the 0.18 release, we've enabled Gzip compression by default for various +content types, including HTML and JSON. Unfortunately, enabling Gzip compression +on such content types could make BREACH-type exploits possible. + +We've removed the risky content-types from our nginx template files, to ensure new +instances are safe, however, if you already have an instance, you need +to double check that your host nginx virtualhost do not include the following +values for the ``gzip_types`` settings:: + + application/atom+xml + application/json + application/ld+json + application/activity+json + application/manifest+json + application/rss+xml + application/xhtml+xml + application/xml + +For convenience, you can also replace the whole setting with the following snippet:: + + gzip_types + application/javascript + application/vnd.geo+json + application/vnd.ms-fontobject + application/x-font-ttf + application/x-web-app-manifest+json + font/opentype + image/bmp + image/svg+xml + image/x-icon + text/cache-manifest + text/css + text/plain + text/vcard + text/vnd.rim.location.xloc + text/vtt + text/x-component + text/x-cross-domain-policy; + +Many thanks to @jibec for the report! + +Fix Apache configuration file for 0.18 [manual action required] +---------------------------------------------------------- + +The way front is served has changed since 0.18. The Apache configuration can't serve 0.18 properly, leading to blank screens. + +If you are on an Apache setup, you will have to replace the `<Location "/api">` block with the following:: + + <Location "/"> + # similar to nginx 'client_max_body_size 100M;' + LimitRequestBody 104857600 + + ProxyPass ${funkwhale-api}/ + ProxyPassReverse ${funkwhale-api}/ + </Location> + +And add some more `ProxyPass` directives so that the `Alias` part of your configuration file looks this way:: + + ProxyPass "/front" "!" + Alias /front /srv/funkwhale/front/dist + + ProxyPass "/media" "!" + Alias /media /srv/funkwhale/data/media + + ProxyPass "/staticfiles" "!" + Alias /staticfiles /srv/funkwhale/data/static + +In case you are using custom css and theming, you also need to match this block:: + + ProxyPass "/settings.json" "!" + Alias /settings.json /srv/funkwhale/custom/settings.json + + ProxyPass "/custom" "!" + Alias /custom /srv/funkwhale/custom + + +Enhancements: + +- Added name attributes on all inputs to improve UX, especially with password managers (#686) +- Disable makemigrations in production and misleading message when running migrate (#685) +- Display progress during file upload +- Hide pagination when there is only one page of results (#681) +- Include shared/public playlists in Subsonic API responses (#684) +- Use proper locale for date-related/duration strings (#670) + + +Bugfixes: + +- Fix transcoding of in-place imported tracks (#688) +- Fixed celery worker defaulting to development settings instead of production +- Fixed crashing Django admin when loading track detail page (#666) +- Fixed list icon alignement on landing page (#668) +- Fixed overescaping issue in notifications and album page (#676) +- Fixed wrong number of affected elements in bulk action modal (#683) +- Fixed wrong URL in documentation for funkwhale_proxy.conf file when deploying using Docker +- Make Apache configuration file work with 0.18 changes (#667) +- Removed potential BREACH exploit because of Gzip compression (#678) +- Upgraded kombu to fix an incompatibility with redis>=3 + + +Documentation: + +- Added user upload documentation at https://docs.funkwhale.audio/users/upload.html + + 0.18 "Naomi" (2019-01-22) ------------------------- diff --git a/api/funkwhale_api/__init__.py b/api/funkwhale_api/__init__.py index b6e74547810ecf92c68ba32f16c2b4324770dc70..bc4976716c137ec2b391935e5493aaf6f17efa42 100644 --- a/api/funkwhale_api/__init__.py +++ b/api/funkwhale_api/__init__.py @@ -1,5 +1,5 @@ # -*- coding: utf-8 -*- -__version__ = "0.18" +__version__ = "0.18.1" __version_info__ = tuple( [ int(num) if num.isdigit() else num diff --git a/changes/changelog.d/666.bugfix b/changes/changelog.d/666.bugfix deleted file mode 100644 index 5027dd403417103eea2355f91ebfcc7efac53ba9..0000000000000000000000000000000000000000 --- a/changes/changelog.d/666.bugfix +++ /dev/null @@ -1 +0,0 @@ -Fixed crashing Django admin when loading track detail page (#666) diff --git a/changes/changelog.d/667.bugfix b/changes/changelog.d/667.bugfix deleted file mode 100644 index d553867cae1c9d211bf6cf5f116673cfa87227fc..0000000000000000000000000000000000000000 --- a/changes/changelog.d/667.bugfix +++ /dev/null @@ -1 +0,0 @@ -Make Apache configuration file work with 0.18 changes (#667) diff --git a/changes/changelog.d/668.bugfix b/changes/changelog.d/668.bugfix deleted file mode 100644 index 5f4f878d38219f25cbccea99addcee6a758123b3..0000000000000000000000000000000000000000 --- a/changes/changelog.d/668.bugfix +++ /dev/null @@ -1 +0,0 @@ -Fixed list icon alignement on landing page (#668) diff --git a/changes/changelog.d/670.enhancement b/changes/changelog.d/670.enhancement deleted file mode 100644 index 8da3f97f8e288cf0ac9cf263a6299ec9b33eaca2..0000000000000000000000000000000000000000 --- a/changes/changelog.d/670.enhancement +++ /dev/null @@ -1 +0,0 @@ -Use proper locale for date-related/duration strings (#670) diff --git a/changes/changelog.d/676.bugfix b/changes/changelog.d/676.bugfix deleted file mode 100644 index 30829cd19d66a99c9876ca7b19522c8837484f96..0000000000000000000000000000000000000000 --- a/changes/changelog.d/676.bugfix +++ /dev/null @@ -1 +0,0 @@ -Fixed overescaping issue in notifications and album page (#676) diff --git a/changes/changelog.d/678.bugfix b/changes/changelog.d/678.bugfix deleted file mode 100644 index ba508bb879718f382c26d899e0d224585871f934..0000000000000000000000000000000000000000 --- a/changes/changelog.d/678.bugfix +++ /dev/null @@ -1 +0,0 @@ -Removed potential BREACH exploit because of Gzip compression (#678) diff --git a/changes/changelog.d/681.enhancement b/changes/changelog.d/681.enhancement deleted file mode 100644 index 9f872310623ba8e5eb3a63ab4263d5a85a8c4b92..0000000000000000000000000000000000000000 --- a/changes/changelog.d/681.enhancement +++ /dev/null @@ -1 +0,0 @@ -Hide pagination when there is only one page of results (#681) \ No newline at end of file diff --git a/changes/changelog.d/683.bugfix b/changes/changelog.d/683.bugfix deleted file mode 100644 index 18cc3a7ae26db65906243aff92bf6790e237c629..0000000000000000000000000000000000000000 --- a/changes/changelog.d/683.bugfix +++ /dev/null @@ -1 +0,0 @@ -Fixed wrong number of affected elements in bulk action modal (#683) diff --git a/changes/changelog.d/684.enhancement b/changes/changelog.d/684.enhancement deleted file mode 100644 index 1cdd0cdd90d4f5b130213c6fb0909c948057a5c0..0000000000000000000000000000000000000000 --- a/changes/changelog.d/684.enhancement +++ /dev/null @@ -1 +0,0 @@ -Include shared/public playlists in Subsonic API responses (#684) diff --git a/changes/changelog.d/685.enhancement b/changes/changelog.d/685.enhancement deleted file mode 100644 index f9cc105abd5540e455e7dd80a1e50cabb6f8d6e3..0000000000000000000000000000000000000000 --- a/changes/changelog.d/685.enhancement +++ /dev/null @@ -1 +0,0 @@ -Disable makemigrations in production and misleading message when running migrate (#685) diff --git a/changes/changelog.d/686.enhancement b/changes/changelog.d/686.enhancement deleted file mode 100644 index c346a9ab4622de6359dd9057cb8a1dad5dd9e7c7..0000000000000000000000000000000000000000 --- a/changes/changelog.d/686.enhancement +++ /dev/null @@ -1 +0,0 @@ -Added name attributes on all inputs to improve UX, especially with password managers (#686) diff --git a/changes/changelog.d/688.bugfix b/changes/changelog.d/688.bugfix deleted file mode 100644 index 085f205cd9d461d389f1eab27d27d6ef6d6a76d7..0000000000000000000000000000000000000000 --- a/changes/changelog.d/688.bugfix +++ /dev/null @@ -1 +0,0 @@ -Fix transcoding of in-place imported tracks (#688) diff --git a/changes/changelog.d/celery.bugfix b/changes/changelog.d/celery.bugfix deleted file mode 100644 index 448a536e6acd03e69ed680afccfa3e0ff6b3dcc4..0000000000000000000000000000000000000000 --- a/changes/changelog.d/celery.bugfix +++ /dev/null @@ -1 +0,0 @@ -Fixed celery worker defaulting to development settings instead of production diff --git a/changes/changelog.d/docker-proxy.bugfix b/changes/changelog.d/docker-proxy.bugfix deleted file mode 100644 index 9dac8ffb34853988ef4659022bfa6fa02590d580..0000000000000000000000000000000000000000 --- a/changes/changelog.d/docker-proxy.bugfix +++ /dev/null @@ -1 +0,0 @@ -Fixed wrong URL in documentation for funkwhale_proxy.conf file when deploying using Docker diff --git a/changes/changelog.d/kombu.bugfix b/changes/changelog.d/kombu.bugfix deleted file mode 100644 index 01469f29e9b7c7a60a602fce72b5aedbd95d71a8..0000000000000000000000000000000000000000 --- a/changes/changelog.d/kombu.bugfix +++ /dev/null @@ -1 +0,0 @@ -Upgraded kombu to fix an incompatibility with redis>=3 diff --git a/changes/changelog.d/progress.enhancement b/changes/changelog.d/progress.enhancement deleted file mode 100644 index cbd50903f2305687f7f51ccb990ba7ec617713c9..0000000000000000000000000000000000000000 --- a/changes/changelog.d/progress.enhancement +++ /dev/null @@ -1 +0,0 @@ -Display progress during file upload diff --git a/changes/changelog.d/upload.doc b/changes/changelog.d/upload.doc deleted file mode 100644 index 0b2506fc45ad300159f4d1a6538be2c842033233..0000000000000000000000000000000000000000 --- a/changes/changelog.d/upload.doc +++ /dev/null @@ -1 +0,0 @@ -Added user upload documentation diff --git a/changes/notes.rst b/changes/notes.rst index 1276dd010b33d74da0ef0ff9c87da11133835122..96ac3d7651f92166072a2fb200c0dd57606851e3 100644 --- a/changes/notes.rst +++ b/changes/notes.rst @@ -5,80 +5,3 @@ Next release notes Those release notes refer to the current development branch and are reset after each release. - -Fix Gzip compression to avoid BREACH exploit [security] [manual action required] --------------------------------------------------------------------------------- - -In the 0.18 release, we've enabled Gzip compression by default for various -content types, including HTML and JSON. Unfortunately, enabling Gzip compression -on such content types could make BREACH-type exploits possible. - -We've removed the risky content-types from our nginx template files, to ensure new -instances are safe, however, if you already have an instance, you need -to double check that your host nginx virtualhost do not include the following -values for the ``gzip_types`` settings:: - - application/atom+xml - application/json - application/ld+json - application/activity+json - application/manifest+json - application/rss+xml - application/xhtml+xml - application/xml - -For convenience, you can also replace the whole setting with the following snippet:: - - gzip_types - application/javascript - application/vnd.geo+json - application/vnd.ms-fontobject - application/x-font-ttf - application/x-web-app-manifest+json - font/opentype - image/bmp - image/svg+xml - image/x-icon - text/cache-manifest - text/css - text/plain - text/vcard - text/vnd.rim.location.xloc - text/vtt - text/x-component - text/x-cross-domain-policy; - - -Fix Apache configuration file for 0.18 [manual action required] ----------------------------------------------------------- - -The way front is served has changed since 0.18. The Apache configuration can't serve 0.18 properly, leading to blank screens. - -If you are on an Apache setup, you will have to replace the `<Location "/api">` block with the following:: - - <Location "/"> - # similar to nginx 'client_max_body_size 100M;' - LimitRequestBody 104857600 - - ProxyPass ${funkwhale-api}/ - ProxyPassReverse ${funkwhale-api}/ - </Location> - -And add some more `ProxyPass` directives so that the `Alias` part of your configuration file looks this way:: - - ProxyPass "/front" "!" - Alias /front /srv/funkwhale/front/dist - - ProxyPass "/media" "!" - Alias /media /srv/funkwhale/data/media - - ProxyPass "/staticfiles" "!" - Alias /staticfiles /srv/funkwhale/data/static - -In case you are using custom css and theming, you also need to match this block:: - - ProxyPass "/settings.json" "!" - Alias /settings.json /srv/funkwhale/custom/settings.json - - ProxyPass "/custom" "!" - Alias /custom /srv/funkwhale/custom diff --git a/docs/upgrading/index.rst b/docs/upgrading/index.rst index 7942bd28853ca74884f6605f01967fba71eede29..577066fc3484fb48e748f49bbd678860268de7da 100644 --- a/docs/upgrading/index.rst +++ b/docs/upgrading/index.rst @@ -62,7 +62,7 @@ easy: This is a warning, not an error, and it can be safely ignored. Never run the ``makemigrations`` command yourself. - + Upgrading the Postgres container ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ @@ -78,18 +78,18 @@ Thankfully, there is a Docker container available to automate this process. You can use the following snippet to upgrade your database in ``./postgres``, keeping a backup of the old version in ``./postgres-old``: -.. parsed-literal:: +.. code-block:: shell # Replace "9.4" and "11" with the versions you are migrating between. export OLD_POSTGRES=9.4 export NEW_POSTGRES=11 docker-compose stop postgres docker run --rm \ - -v `pwd`/data/postgres:/var/lib/postgresql/${OLD_POSTGRES}/data \ - -v `pwd`/data/postgres-new:/var/lib/postgresql/${NEW_POSTGRES}/data \ + -v $(pwd)/data/postgres:/var/lib/postgresql/${OLD_POSTGRES}/data \ + -v $(pwd)/data/postgres-new:/var/lib/postgresql/${NEW_POSTGRES}/data \ tianon/postgres-upgrade:${OLD_POSTGRES}-to-${NEW_POSTGRES} # Add back the access control rule that doesn't survive the upgrade - echo "host all all all trust" | sudo tee -a ./postgres-new/pg_hba.conf + echo "host all all all trust" | sudo tee -a ./data/postgres-new/pg_hba.conf # Swap over to the new database mv ./data/postgres ./data/postgres-old mv ./data/postgres-new ./data/postgres