Blame SPECS/rubygem-actionpack.spec

440baf
%{?scl:%scl_package rubygem-%{gem_name}}
440baf
%{!?scl:%global pkg_name %{name}}
440baf
440baf
# Generated from actionpack-1.13.5.gem by gem2rpm -*- rpm-spec -*-
440baf
%global gem_name actionpack
440baf
440baf
# Fallback to rh-nodejs4 rh-nodejs4-scldevel is probably not available in
440baf
# the buildroot.
440baf
%{!?scl_nodejs:%global scl_nodejs rh-nodejs4}
440baf
%{!?scl_prefix_nodejs:%global scl_prefix_nodejs %{scl_nodejs}-}
440baf
440baf
%global bootstrap 0
440baf
440baf
Summary: Web-flow and rendering framework putting the VC in MVC
440baf
Name: %{?scl_prefix}rubygem-%{gem_name}
440baf
Epoch: 1
440baf
Version: 4.2.6
2c61bb
Release: 5%{?dist}
440baf
Group: Development/Languages
440baf
License: MIT
440baf
URL: http://www.rubyonrails.org
440baf
Source0: http://rubygems.org/downloads/actionpack-%{version}.gem
440baf
440baf
# Also the actionpack gem doesn't ship with the test suite.
440baf
# You may check it out like so
440baf
# git clone http://github.com/rails/rails.git
440baf
# cd rails/actionpack/
440baf
# git checkout v4.2.6
440baf
# tar czvf actionpack-4.2.6-tests.tgz test/
440baf
Source2: actionpack-%{version}-tests.tgz
440baf
0f7aad
# Fix CVE-2016-6317 unsafe query generation in Active Record
0f7aad
# https://bugzilla.redhat.com/show_bug.cgi?id=1365017
0f7aad
Patch0: rubygem-actionpack-4.2.7.1-CVE-2016-6317-unsafe-query-tests.patch
2c61bb
# CVE-2019-5418: Render file directory traversal in Action View
2c61bb
# https://bugzilla.redhat.com/show_bug.cgi?id=1689159
2c61bb
# CVE-2019-5419: Denial of service vulnerability in Action View
2c61bb
# https://bugzilla.redhat.com/show_bug.cgi?id=1689160
2c61bb
# https://github.com/rails/rails/commit/58ed245e80a8710fbe31e91417bfd19f9f934cc4
2c61bb
Patch1: rubygem-actionpack-4.2.11.1-CVE-2019-5418-CVE-2019-5419-render-file.patch
2c61bb
Patch2: rubygem-actionpack-4.2.11.1-CVE-2019-5418-CVE-2019-5419-render-file-tests.patch
0f7aad
440baf
# Let's keep Requires and BuildRequires sorted alphabeticaly
440baf
Requires: %{?scl_prefix_ruby}ruby(release)
440baf
Requires: %{?scl_prefix_ruby}ruby(rubygems)
440baf
Requires: %{?scl_prefix}rubygem(actionview) = %{version}
440baf
Requires: %{?scl_prefix}rubygem(activesupport) = %{version}
440baf
Requires: %{?scl_prefix}rubygem(rack) >= 1.6
440baf
Requires: %{?scl_prefix}rubygem(rack) < 2
440baf
Requires: %{?scl_prefix}rubygem(rack-test) >= 0.6.2
440baf
Requires: %{?scl_prefix}rubygem(rack-test) < 0.7
440baf
Requires: %{?scl_prefix}rubygem(rails-dom-testing) >= 1.0.5
440baf
Requires: %{?scl_prefix}rubygem(rails-dom-testing) < 2
440baf
Requires: %{?scl_prefix}rubygem(rails-html-sanitizer) >= 1.0.2
440baf
Requires: %{?scl_prefix}rubygem(rails-html-sanitizer) < 2
440baf
BuildRequires: %{?scl_prefix_ruby}rubygems-devel
440baf
BuildRequires: %{?scl_prefix_ruby}rubygem(minitest)
440baf
%if 0%{bootstrap} < 1
440baf
BuildRequires: %{?scl_prefix}rubygem(activemodel) = %{version}
440baf
BuildRequires: %{?scl_prefix}rubygem(activerecord) = %{version}
440baf
BuildRequires: %{?scl_prefix}rubygem(activesupport) = %{version}
440baf
BuildRequires: %{?scl_prefix}rubygem(actionview) = %{version}
440baf
BuildRequires: %{?scl_prefix}rubygem(railties) = %{version}
440baf
BuildRequires: %{?scl_prefix}rubygem(journey) >= 1.0.4
440baf
BuildRequires: %{?scl_prefix}rubygem(journey) < 1.1
440baf
BuildRequires: %{?scl_prefix}rubygem(mocha) >= 0.9.8
440baf
BuildRequires: %{?scl_prefix}rubygem(rack) >= 1.6
440baf
BuildRequires: %{?scl_prefix}rubygem(rack) < 1.7
440baf
BuildRequires: %{?scl_prefix}rubygem(rack-cache) >= 1.2
440baf
BuildRequires: %{?scl_prefix}rubygem(rack-cache) < 2
440baf
BuildRequires: %{?scl_prefix}rubygem(rack-test) >= 0.6.2
440baf
BuildRequires: %{?scl_prefix}rubygem(rack-test) < 0.7
440baf
BuildRequires: %{?scl_prefix}rubygem(sqlite3)
440baf
BuildRequires: %{?scl_prefix}rubygem(tzinfo)
440baf
BuildRequires: %{?scl_prefix}rubygem(uglifier)
440baf
%endif
440baf
BuildArch: noarch
440baf
Provides: %{?scl_prefix}rubygem(%{gem_name}) = %{version}
440baf
2c61bb
# Explicitly require runtime subpackage, as long as older scl-utils do not generate it
2c61bb
Requires: %{?scl_prefix}runtime
2c61bb
440baf
BuildRequires: %{?scl_prefix_nodejs}nodejs
440baf
440baf
%description
440baf
Eases web-request routing, handling, and response as a half-way front,
440baf
half-way page controller. Implemented with specific emphasis on enabling easy
440baf
unit/integration testing that doesn't require a browser.
440baf
440baf
%package doc
440baf
Summary: Documentation for %{pkg_name}
440baf
Group: Documentation
440baf
Requires:%{?scl_prefix}%{pkg_name} = %{epoch}:%{version}-%{release}
440baf
440baf
%description doc
440baf
Documentation for %{pkg_name}
440baf
440baf
%prep
440baf
%setup -n %{pkg_name}-%{version} -q -c -T
440baf
%{?scl:scl enable %{scl} - << \EOF}
440baf
%gem_install -n %{SOURCE0}
440baf
%{?scl:EOF}
440baf
2c61bb
pushd .%{gem_instdir}
2c61bb
%patch1 -p2 -F 0
2c61bb
popd
2c61bb
440baf
# move the tests into place
440baf
tar xzvf %{SOURCE2} -C .%{gem_instdir}
440baf
440baf
# Remove backup files
440baf
# No! these are needed for rake test
440baf
# find ./%%{gem_instdir} -type f -name "*~" -delete
440baf
440baf
# Delete zero-length files
440baf
# No! these are also needed for rake test
440baf
# find ./%%{gem_instdir} -type f -size 0c -exec rm -rvf {} \;
440baf
440baf
# Fix anything executable that does not have a shebang
440baf
for file in `find ./%{gem_instdir} -type f -perm /a+x`; do
440baf
    [ -z "`head -n 1 $file | grep \"^#!/\"`" ] && chmod -v 644 $file
440baf
done
440baf
440baf
# Find files with a shebang that do not have executable permissions
440baf
for file in `find ./%{gem_instdir} -type f ! -perm /a+x -name "*.rb"`; do
440baf
    [ ! -z "`head -n 1 $file | grep \"^#!/\"`" ] && chmod -v 755 $file
440baf
done
440baf
440baf
%build
440baf
440baf
%install
440baf
mkdir -p %{buildroot}%{gem_dir}
440baf
cp -a .%{gem_dir}/* %{buildroot}%{gem_dir}
440baf
440baf
%clean
440baf
rm -rf %{buildroot}
440baf
440baf
%if 0%{bootstrap} < 1
440baf
440baf
%check
440baf
pushd .%{gem_instdir}
440baf
0f7aad
patch -p2 < %{PATCH0}
2c61bb
patch -p2 < %{PATCH2}
0f7aad
440baf
# load_path is not available, remove its require.
440baf
sed -i '1,2d' test/abstract_unit.rb
440baf
440baf
# fix rack/test requirement
440baf
sed -i "1i\require 'rack/test'" lib/action_controller/metal/strong_parameters.rb
440baf
440baf
# One test is failing: DebugExceptionsTest#test_debug_exceptions_app_shows_user_code_that_caused_the_error_in_source_view
2c61bb
%if 0%{?rhel} >= 7
0f7aad
sed -i "/^  test 'debug exceptions app shows user code that caused the error in source view' do$/,/^  end$/ s/^/#/" \
0f7aad
  test/dispatch/debug_exceptions_test.rb
2c61bb
%endif
440baf
%{?scl:scl enable %{scl} %{scl_nodejs} - << \EOF}
0f7aad
ruby -w -I.:lib:test -rtimeout -e 'Dir.glob("test/{abstract,controller,dispatch,template}/**/*_test.rb").each {|t| require t}'
440baf
%{?scl:EOF}
440baf
popd
440baf
%endif
440baf
440baf
%files
440baf
%dir %{gem_instdir}
440baf
%doc %{gem_instdir}/MIT-LICENSE
440baf
%{gem_libdir}
440baf
%exclude %{gem_cache}
440baf
%{gem_spec}
440baf
440baf
%files doc
440baf
%doc %{gem_docdir}
440baf
%doc %{gem_instdir}/CHANGELOG.md
440baf
%doc %{gem_instdir}/README.rdoc
440baf
%{gem_instdir}/test/
440baf
440baf
%changelog
2c61bb
* Fri Mar 29 2019 Jun Aruga <jaruga@redhat.com> - 1:4.2.6-5
2c61bb
- Fix a render file directory traversal in Action View
2c61bb
  Resolves: CVE-2019-5418
2c61bb
- Fix a denial of service vulnerability in Action View
2c61bb
  Resolves: CVE-2019-5419
2c61bb
0f7aad
* Thu Aug 18 2016 Jun Aruga <jaruga@redhat.com> - 1:4.2.6-3
0f7aad
- Fix for CVE-2016-6317
0f7aad
  Resolves: rhbz#1365017
0f7aad
440baf
* Wed Apr 06 2016 Pavel Valena <pvalena@redhat.com> - 1:4.2.6-2
440baf
- Enable tests
440baf
440baf
* Mon Apr 04 2016 Pavel Valena <pvalena@redhat.com> - 1:4.2.6-1
440baf
- Update to 4.2.6
440baf
440baf
* Mon Feb 29 2016 Pavel Valena <pvalena@redhat.com> - 1:4.2.5.1-7
440baf
- Allow one failing test
440baf
440baf
* Mon Feb 29 2016 Pavel Valena <pvalena@redhat.com> - 1:4.2.5.1-6
440baf
- Add nodejs to BuildRequires
440baf
440baf
* Wed Feb 17 2016 Pavel Valena <pvalena@redhat.com> - 1:4.2.5.1-5
440baf
- Update to 4.2.5.1
440baf
440baf
* Thu Feb 11 2016 Pavel Valena <pvalena@redhat.com> - 1:4.1.5-3
440baf
- Fix Timing attack vulnerability in Action Controller - rhbz#1301933
440baf
  - Resolves: CVE-2015-7576
440baf
- Fix Possible Object Leak and Denial of Service attack - rhbz#1301946
440baf
  - Resolves: CVE-2016-0751
440baf
- Fix Possible Information Leak Vulnerability - rhbz#1301963
440baf
  - Resolves: CVE-2016-0752
440baf
- Fix Object leak vulnerability for wildcard controller routes - rhbz#1301981
440baf
  - Resolves: CVE-2015-7581
440baf
440baf
* Thu Feb 05 2015 Vít Ondruch <vondruch@redhat.com> - 1:4.1.5-2
440baf
- Remove obsolete patch.
440baf
440baf
* Thu Jan 22 2015 Josef Stribny <jstribny@redhat.com> - 1:4.1.5-1
440baf
- Update to 4.1.5
440baf
440baf
* Wed May 07 2014 Josef Stribny <jstribny@redhat.com> - 1:4.0.2-4
440baf
- Fix for CVE-2014-0130
440baf
  - Resolves: rhbz#1095172
440baf
440baf
* Tue Feb 18 2014 Josef Stribny <jstribny@redhat.com> - 1:4.0.2-3
440baf
- Fixes for CVE-2014-0081
440baf
  - Resolves: rhbz#1065587
440baf
440baf
* Mon Feb 17 2014 Josef Stribny <jstribny@redhat.com> - 1:4.0.2-2
440baf
- Depend on scldevel(v8) virtual provide
440baf
440baf
* Wed Dec 04 2013 Josef Stribny <jstribny@redhat.com> - 1:4.0.2-1
440baf
- Update to ActionPack 4.0.2
440baf
  - Resolves: rhbz#1037985
440baf
- Fix CVE-2013-6417, CVE-2013-6414, CVE-2013-6415, CVE-2013-6416 and CVE-2013-4491
440baf
  - Resolves: rhbz#1036421
440baf
440baf
* Thu Nov 21 2013 Josef Stribny <jstribny@redhat.com> - 1:4.0.1-1
440baf
- Update to ActionPack 4.0.1
440baf
440baf
* Wed Oct 16 2013 Josef Stribny <jstribny@redhat.com> - 1:4.0.0-2
440baf
- Convert to scl
440baf
440baf
* Thu Aug 08 2013 Josef Stribny <jstribny@redhat.com> - 1:4.0.0-1
440baf
- Update to ActionPack 4.0.0.
440baf
440baf
* Sun Aug 04 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1:3.2.13-3
440baf
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
440baf
440baf
* Wed Mar 20 2013 Vít Ondruch <vondruch@redhat.com> - 1:3.2.13-2
440baf
- Test suite passes once again.
440baf
440baf
* Tue Mar 19 2013 Vít Ondruch <vondruch@redhat.com> - 1:3.2.13-1
440baf
- Update to the ActionPack 3.2.13.
440baf
440baf
* Fri Mar 08 2013 Vít Ondruch <vondruch@redhat.com> - 1:3.2.12-2
440baf
- Rebuild for https://fedoraproject.org/wiki/Features/Ruby_2.0.0
440baf
440baf
* Tue Feb 12 2013 Vít Ondruch <vondruch@redhat.com> - 1:3.2.12-1
440baf
- Update to the ActionPack 3.2.12.
440baf
440baf
* Wed Jan 09 2013 Vít Ondruch <vondruch@redhat.com> - 1:3.2.11-1
440baf
- Update to the ActionPack 3.2.11.
440baf
440baf
* Thu Jan 03 2013 Vít Ondruch <vondruch@redhat.com> - 1:3.2.10-1
440baf
- Update to the ActionPack 3.2.10.
440baf
440baf
* Sat Oct 13 2012 Vít Ondruch <vondruch@redhat.com> - 1:3.2.8-2
440baf
- Relaxed Builder dependency.
440baf
440baf
* Mon Aug 13 2012 Vít Ondruch <vondruch@redhat.com> - 1:3.2.8-1
440baf
- Update to the ActionPack 3.2.8.
440baf
440baf
* Wed Aug 01 2012 Bohuslav Kabrda <bkabrda@redhat.com> - 1:3.2.7-2
440baf
- Remove the unneded symlink used for tests in previous versions (RHBZ #840119).
440baf
440baf
* Mon Jul 30 2012 Vít Ondruch <vondruch@redhat.com> - 1:3.2.7-1
440baf
- Update to the ActionPack 3.2.7.
440baf
440baf
* Tue Jul 24 2012 Vít Ondruch <vondruch@redhat.com> - 1:3.2.6-2
440baf
- Fixed missing epoch in -doc subpackage.
440baf
440baf
* Mon Jul 23 2012 Bohuslav Kabrda <bkabrda@redhat.com> - 1:3.2.6-1
440baf
- Updated to the ActionPack 3.2.6.
440baf
- Remove Rake dependency.
440baf
- Introduce -doc subpackage.
440baf
- Relax sprockets dependency.
440baf
440baf
* Sat Jul 21 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1:3.0.15-2
440baf
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
440baf
440baf
* Fri Jun 15 2012 Vít Ondruch <vondruch@redhat.com> - 1:3.0.15-1
440baf
- Updated to the ActionPack 3.0.15.
440baf
440baf
* Fri Jun 01 2012 Vít Ondruch <vondruch@redhat.com> - 1:3.0.13-1
440baf
- Updated to the ActionPack 3.0.13.
440baf
440baf
* Fri Mar 16 2012 Bohuslav Kabrda <bkabrda@redhat.com> - 1:3.0.11-3
440baf
- The CVE patches names now contain the CVE id.
440baf
440baf
* Tue Mar 06 2012 Bohuslav Kabrda <bkabrda@redhat.com> - 1:3.0.11-2
440baf
- Fix for CVE-2012-1098.
440baf
- Fix for CVE-2012-1099.
440baf
440baf
* Tue Jan 31 2012 Bohuslav Kabrda <bkabrda@redhat.com> - 1:3.0.11-1
440baf
- Rebuilt for Ruby 1.9.3.
440baf
- Updated to ActionPack 3.0.11.
440baf
440baf
* Sat Jan 14 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1:3.0.10-2
440baf
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
440baf
440baf
* Mon Aug 22 2011 Vít Ondruch <vondruch@redhat.com> - 1:3.0.10-1
440baf
- Update to ActionPack 3.0.10
440baf
440baf
* Mon Jul 04 2011 Vít Ondruch <vondruch@redhat.com> - 1:3.0.9-1
440baf
- Update to ActionPack 3.0.9
440baf
440baf
* Thu Jun 16 2011 Mo Morsi <mmorsi@redhat.com> - 1:3.0.5-3
440baf
- Include fix for CVE-2011-2197
440baf
440baf
* Fri Jun 03 2011 Vít Ondruch <vondruch@redhat.com> - 1:3.0.5-2
440baf
- Removed regin and multimap dependencies. They were added into rack-mount
440baf
  where they actually belongs.
440baf
440baf
* Fri Mar 25 2011 Vít Ondruch <vondruch@redhat.com> - 1:3.0.5-1
440baf
- Updated to ActionPack 3.0.5
440baf
440baf
* Wed Feb 16 2011 Vít Ondruch <vondruch@redhat.com> - 1:3.0.3-4
440baf
- Relaxed erubis dependency
440baf
- Fixed build compatibility with RubyGems 1.5
440baf
440baf
* Wed Feb 09 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1:3.0.3-3
440baf
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
440baf
440baf
* Mon Feb 07 2011 Mohammed Morsi <mmorsi@redhat.com> - 1:3.0.3-2
440baf
- changelog fixes
440baf
440baf
* Mon Jan 10 2011 Mohammed Morsi <mmorsi@redhat.com> - 1:3.0.3-1
440baf
- Update to rails 3
440baf
440baf
* Thu Aug 12 2010 Mohammed Morsi <mmorsi@redhat.com> - 1:2.3.8-2
440baf
- Bumped actionpack rack dependency to version 1.1.0
440baf
440baf
* Mon Aug 09 2010 Mohammed Morsi <mmorsi@redhat.com> - 1:2.3.8-1
440baf
- Update to 2.3.8
440baf
440baf
* Mon May 17 2010 Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1:2.3.5-2
440baf
- Set TMPDIR environment at %%check to make it sure all files created
440baf
  during rpmbuild are cleaned up
440baf
440baf
* Thu Jan 28 2010 Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1:2.3.5-1
440baf
- Update to 2.3.5
440baf
440baf
* Fri Jan  8 2010 Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1:2.3.4-4
440baf
- Workaround patch to fix for rack 1.1.0 dependency (bug 552972)
440baf
440baf
* Thu Dec 10 2009 David Lutterkort <lutter@redhat.com> - 1:2.3.4-3
440baf
- Patch for CVE-2009-4214 (bz 542786)
440baf
440baf
* Wed Oct  7 2009 David Lutterkort <lutter@redhat.com> - 1:2.3.4-2
440baf
- Bump Epoch to ensure upgrade path from F-11
440baf
440baf
* Sun Sep 20 2009 Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 2.3.4-1
440baf
- Update to 2.3.4 (bug 520843, CVE-2009-3009)
440baf
- Fix tests
440baf
440baf
* Sun Aug  2 2009 Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 2.3.3-1
440baf
- 2.3.3
440baf
- Enable test (some tests fail, please someone investigate!!)
440baf
440baf
* Sun Jul 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.3.2-2
440baf
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
440baf
440baf
* Mon Mar 16 2009 Jeroen van Meeuwen <j.van.meeuwen@ogd.nl> - 2.3.2-1
440baf
- New upstream version
440baf
440baf
* Wed Feb 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.2.2-2
440baf
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
440baf
440baf
* Tue Dec 23 2008 David Lutterkort <lutter@redhat.com> - 2.2.2-1
440baf
- New version
440baf
440baf
* Tue Sep 16 2008 David Lutterkort <dlutter@redhat.com> - 2.1.1-1
440baf
- New version (fixes CVE-2008-4094)
440baf
440baf
* Thu Jul 31 2008 Michael Stahnke <stahnma@fedoraproject.org> - 2.1.0-1
440baf
- New Upstream
440baf
440baf
* Tue Apr  8 2008 David Lutterkort <dlutter@redhat.com> - 2.0.2-2
440baf
- Fix dependency
440baf
440baf
* Mon Apr 07 2008 David Lutterkort <dlutter@redhat.com> - 2.0.2-1
440baf
- New version
440baf
440baf
* Mon Dec 10 2007 David Lutterkort <dlutter@redhat.com> - 2.0.1-1
440baf
- New version
440baf
440baf
* Thu Nov 29 2007 David Lutterkort <dlutter@redhat.com> - 1.13.6-1
440baf
- New version
440baf
440baf
* Tue Nov 13 2007 David Lutterkort <dlutter@redhat.com> - 1.13.5-2
440baf
- Fix buildroot; mark docs in geminstdir cleanly
440baf
440baf
* Tue Oct 30 2007 David Lutterkort <dlutter@redhat.com> - 1.13.5-1
440baf
- Initial package