8.9.2-debian-10-r16 release

This commit is contained in:
Bitnami Bot 2020-07-30 01:00:48 +00:00
parent e93a2f4a96
commit 72ee4b3c3f
11 changed files with 179 additions and 141 deletions

View File

@ -14,20 +14,20 @@ RUN . /opt/bitnami/scripts/libcomponent.sh && component_unpack "nginx" "1.18.0-2
RUN . /opt/bitnami/scripts/libcomponent.sh && component_unpack "mysql-client" "10.3.23-1" --checksum efab843077267af6a8cde53440a1fef0acf8cb67ab1dcd0b6da2e9cbe050c7e1
RUN . /opt/bitnami/scripts/libcomponent.sh && component_unpack "render-template" "1.0.0-1" --checksum a94f94357aa06f3718db1550fa5f5188cd61383d66bf754eef49c58a18bf02cc
RUN . /opt/bitnami/scripts/libcomponent.sh && component_unpack "gosu" "1.12.0-1" --checksum 51cfb1b7fd7b05b8abd1df0278c698103a9b1a4964bdacd87ca1d5c01631d59c
RUN . /opt/bitnami/scripts/libcomponent.sh && component_unpack "drupal" "8.9.2-1" --checksum fe715bb44555df198f01b2dc2d814cf23be5cd46074b66bf8318440d6999604e
RUN . /opt/bitnami/scripts/libcomponent.sh && component_unpack "drupal" "8.9.2-2" --checksum fdbbaca8a4abfca04c812b9d0eec9eb2ab87c98edc207af9945a7b830eff7890
RUN apt-get update && apt-get upgrade -y && \
rm -r /var/lib/apt/lists /var/cache/apt/archives
RUN chmod g+rwX /opt/bitnami
COPY rootfs /
RUN /opt/bitnami/scripts/nginx/postunpack.sh
RUN /opt/bitnami/scripts/php/postunpack.sh
RUN /opt/bitnami/scripts/nginx/postunpack.sh
RUN /opt/bitnami/scripts/nginx-php-fpm/postunpack.sh
RUN /opt/bitnami/scripts/drupal/postunpack.sh
RUN /opt/bitnami/scripts/mysql-client/postunpack.sh
ENV ALLOW_EMPTY_PASSWORD="no" \
BITNAMI_APP_NAME="drupal-nginx" \
BITNAMI_IMAGE_VERSION="8.9.2-debian-10-r15" \
BITNAMI_IMAGE_VERSION="8.9.2-debian-10-r16" \
DRUPAL_DATABASE_NAME="" \
DRUPAL_DATABASE_PASSWORD="" \
DRUPAL_DATABASE_USER="" \

View File

@ -0,0 +1 @@
{"drupal": {"arch": "amd64", "digest": "fdbbaca8a4abfca04c812b9d0eec9eb2ab87c98edc207af9945a7b830eff7890", "distro": "debian-10", "type": "NAMI", "version": "8.9.2-2"}, "gosu": {"arch": "amd64", "digest": "51cfb1b7fd7b05b8abd1df0278c698103a9b1a4964bdacd87ca1d5c01631d59c", "distro": "debian-10", "type": "NAMI", "version": "1.12.0-1"}, "mysql-client": {"arch": "amd64", "digest": "efab843077267af6a8cde53440a1fef0acf8cb67ab1dcd0b6da2e9cbe050c7e1", "distro": "debian-10", "type": "NAMI", "version": "10.3.23-1"}, "nginx": {"arch": "amd64", "digest": "869382c601b230b458216860bb0ef6ec791f578ff0b0f53b2ab6269341b844a9", "distro": "debian-10", "type": "NAMI", "version": "1.18.0-2"}, "php": {"arch": "amd64", "digest": "5fea2ffac007503364e906f5ad5444336aaaf4b360045f75f58ec220610bc8b1", "distro": "debian-10", "type": "NAMI", "version": "7.3.20-1"}, "render-template": {"arch": "amd64", "digest": "a94f94357aa06f3718db1550fa5f5188cd61383d66bf754eef49c58a18bf02cc", "distro": "debian-10", "type": "NAMI", "version": "1.0.0-1"}}

View File

@ -62,8 +62,4 @@ component_unpack() {
fi
tar --directory "${directory}" --extract --gunzip --file "${base_name}.tar.gz" --no-same-owner --strip-components=2 "${base_name}/files/"
rm "${base_name}.tar.gz"
# Include metadata about the package
touch "${directory}/.bitnami_packages"
echo "$base_name" >> "${directory}/.bitnami_packages"
}

View File

@ -2,19 +2,35 @@
#
# Bitnami web server handler library
# shellcheck disable=SC1091
# shellcheck disable=SC1090,SC1091
# Load generic libraries
. /opt/bitnami/scripts/liblog.sh
# Load web server libraries
[[ -f "/opt/bitnami/scripts/libapache.sh" ]] && . /opt/bitnami/scripts/libapache.sh
[[ -f "/opt/bitnami/scripts/libnginx.sh" ]] && . /opt/bitnami/scripts/libnginx.sh
########################
# Execute a command (or list of commands) with the web server environment and library loaded
# Globals:
# *
# Arguments:
# None
# Returns:
# None
#########################
web_server_execute() {
local -r web_server="${1:?missing web server}"
shift
# Run program in sub-shell to avoid web server environment getting loaded when not necessary
(
. "/opt/bitnami/scripts/lib${web_server}.sh"
. "/opt/bitnami/scripts/${web_server}-env.sh"
"$@"
)
}
########################
# Prints the list of enabled web servers
# Globals:
# WEB_SERVER_TYPE
# None
# Arguments:
# None
# Returns:
@ -32,7 +48,7 @@ web_server_list() {
########################
# Prints the currently-enabled web server type (only one, in order of preference)
# Globals:
# WEB_SERVER_TYPE
# None
# Arguments:
# None
# Returns:
@ -47,7 +63,7 @@ web_server_type() {
########################
# Validate that a supported web server is configured
# Globals:
# WEB_SERVER_*
# None
# Arguments:
# None
# Returns:
@ -65,7 +81,7 @@ web_server_validate() {
if [[ -z "$(web_server_type)" || ! " ${supported_web_servers[*]} " == *" $(web_server_type) "* ]]; then
print_validation_error "Could not detect any supported web servers. It must be one of: ${supported_web_servers[*]}"
elif ! type -t "is_$(web_server_type)_running" >/dev/null; then
elif ! web_server_execute "$(web_server_type)" type -t "is_$(web_server_type)_running" >/dev/null; then
print_validation_error "Could not load the $(web_server_type) web server library from /opt/bitnami/scripts. Check that it exists and is readable."
fi
@ -170,53 +186,56 @@ web_server_reload() {
########################
ensure_web_server_app_configuration_exists() {
local app="${1:?missing app}"
local -a web_servers args
shift
local -a apache_args nginx_args web_servers args_var
apache_args=("$app")
nginx_args=("$app")
# Validate arguments
while [[ "$#" -gt 0 ]]; do
case "$1" in
# Common flags
--hosts \
| --type \
| --allow-remote-connections \
| --disabled \
| --enable-https \
| --http-port \
| --https-port \
| --document-root \
)
apache_args+=("$1" "${2:?missing value}")
nginx_args+=("$1" "${2:?missing value}")
shift
;;
# Specific Apache flags
--apache-additional-configuration \
| --apache-before-vhost-configuration \
| --apache-allow-override \
| --apache-extra-directory-configuration \
| --apache-move-htaccess \
)
apache_args+=("${1//apache-/}" "${2:?missing value}")
shift
;;
# Specific NGINX flags
--nginx-additional-configuration)
nginx_args+=("${1//nginx-/}" "${2:?missing value}")
shift
;;
*)
echo "Invalid command line flag $1" >&2
return 1
;;
esac
shift
done
read -r -a web_servers <<< "$(web_server_list)"
for web_server in "${web_servers[@]}"; do
args=("$app")
# Validate arguments
shift
while [[ "$#" -gt 0 ]]; do
case "$1" in
# Common flags
--hosts \
| --type \
| --allow-remote-connections \
| --disabled \
| --enable-https \
| --http-port \
| --https-port \
| --document-root \
)
args+=("$1" "${2:?missing value}")
shift
;;
# Specific Apache flags
--apache-additional-configuration \
| --apache-before-vhost-configuration \
| --apache-allow-override \
| --apache-extra-directory-configuration \
| --apache-move-htaccess \
)
[[ "$web_server" == "apache" ]] && args+=("${1//apache-/}" "${2:?missing value}")
shift
;;
# Specific NGINX flags
--nginx-additional-configuration)
[[ "$web_server" == "nginx" ]] && args+=("${1//nginx-/}" "${2:?missing value}")
shift
;;
*)
echo "Invalid command line flag $1" >&2
return 1
;;
esac
shift
done
"ensure_${web_server}_app_configuration_exists" "${args[@]}"
args_var="${web_server}_args[@]"
web_server_execute "$web_server" "ensure_${web_server}_app_configuration_exists" "${!args_var}"
done
}
@ -235,7 +254,7 @@ ensure_web_server_app_configuration_not_exists() {
local -a web_servers
read -r -a web_servers <<< "$(web_server_list)"
for web_server in "${web_servers[@]}"; do
"ensure_${web_server}_app_configuration_not_exists" "$app"
web_server_execute "$web_server" "ensure_${web_server}_app_configuration_not_exists" "$app"
done
}
@ -263,48 +282,51 @@ ensure_web_server_app_configuration_not_exists() {
########################
ensure_web_server_prefix_configuration_exists() {
local app="${1:?missing app}"
local -a web_servers args
shift
local -a apache_args nginx_args web_servers args_var
apache_args=("$app")
nginx_args=("$app")
# Validate arguments
while [[ "$#" -gt 0 ]]; do
case "$1" in
# Common flags
--allow-remote-connections \
| --document-root \
| --prefix \
| --type \
)
apache_args+=("$1" "${2:?missing value}")
nginx_args+=("$1" "${2:?missing value}")
shift
;;
# Specific Apache flags
--apache-additional-configuration \
| --apache-allow-override \
| --apache-extra-directory-configuration \
| --apache-move-htaccess \
)
apache_args+=("${1//apache-/}" "$2")
shift
;;
# Specific NGINX flags
--nginx-additional-configuration)
nginx_args+=("${1//nginx-/}" "$2")
shift
;;
*)
echo "Invalid command line flag $1" >&2
return 1
;;
esac
shift
done
read -r -a web_servers <<< "$(web_server_list)"
for web_server in "${web_servers[@]}"; do
args=("$app")
# Validate arguments
shift
while [[ "$#" -gt 0 ]]; do
case "$1" in
# Common flags
--allow-remote-connections \
| --document-root \
| --prefix \
| --type \
)
args+=("$1" "${2:?missing value}")
shift
;;
# Specific Apache flags
--apache-additional-configuration \
| --apache-allow-override \
| --apache-extra-directory-configuration \
| --apache-move-htaccess \
)
[[ "$web_server" == "apache" ]] && args+=("${1//apache-/}" "$2")
shift
;;
# Specific NGINX flags
--nginx-additional-configuration)
[[ "$web_server" == "nginx" ]] && args+=("${1//nginx-/}" "$2")
shift
;;
*)
echo "Invalid command line flag $1" >&2
return 1
;;
esac
shift
done
"ensure_${web_server}_prefix_configuration_exists" "${args[@]}"
args_var="${web_server}_args[@]"
web_server_execute "$web_server" "ensure_${web_server}_prefix_configuration_exists" "${!args_var}"
done
}
@ -325,32 +347,32 @@ ensure_web_server_prefix_configuration_exists() {
########################
web_server_update_app_configuration() {
local app="${1:?missing app}"
local -a web_servers args
shift
local -a args web_servers
args=("$app")
# Validate arguments
while [[ "$#" -gt 0 ]]; do
case "$1" in
# Common flags
--hosts \
| --enable-https \
| --http-port \
| --https-port \
)
args+=("$1" "${2:?missing value}")
shift
;;
*)
echo "Invalid command line flag $1" >&2
return 1
;;
esac
shift
done
read -r -a web_servers <<< "$(web_server_list)"
for web_server in "${web_servers[@]}"; do
args=("$app")
# Validate arguments
shift
while [[ "$#" -gt 0 ]]; do
case "$1" in
# Common flags
--hosts \
| --enable-https \
| --http-port \
| --https-port \
)
args+=("$1" "${2:?missing value}")
shift
;;
*)
echo "Invalid command line flag $1" >&2
return 1
;;
esac
shift
done
"${web_server}_update_app_configuration" "${args[@]}"
web_server_execute "$web_server" "${web_server}_update_app_configuration" "${args[@]}"
done
}

View File

@ -115,5 +115,13 @@ location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
log_not_found off;
}'
# Fix common issues running Drupal on top of the NGINX web server, if enabled
# See: https://pantheon.io/blog/update-your-nginx-config-drupal-8
nginx_php_fpm_conf_file="${BITNAMI_ROOT_DIR}/nginx/conf/bitnami/php-fpm.conf"
if [[ -f "$nginx_php_fpm_conf_file" ]]; then
replace_in_file "$nginx_php_fpm_conf_file" '^(\s*)(fastcgi_index\s+index\.php;)$' '\1\2\n\1fastcgi_split_path_info ^(.+?\.php)(|/.*)$;'
replace_in_file "$nginx_php_fpm_conf_file" '(\s\\.php\$)(\s)' '\1|^/update.php\2'
fi
# Re-create .htaccess file after being moved into 'apache/conf/vhosts/htaccess' directory, to avoid Drupal warning
drupal_fix_htaccess_warning_protection

View File

@ -230,21 +230,23 @@ ensure_nginx_app_configuration_exists() {
[[ -z "${https_listen_configuration:-}" ]] && https_listen_configuration="$https_listen" || https_listen_configuration="${https_listen_configuration}${https_listen}"
done
else
http_listen_configuration=$'\n'"listen ${http_port};"
https_listen_configuration=$'\n'"listen ${https_port} ssl;"
http_listen_configuration=$'\n'"listen ${http_port} default_server;"
https_listen_configuration=$'\n'"listen ${https_port} ssl default_server;"
fi
# ACL configuration
export acl_configuration=""
if ! is_boolean_yes "$allow_remote_connections"; then
acl_configuration="
allow 127.0.0.1;
deny all;
default_type text/html;
if (\$remote_addr != 127.0.0.1) {
return 403 'For security reasons, this URL is only accessible using localhost (127.0.0.1) as the hostname.';
}
# Avoid absolute redirects when connecting through a SSH tunnel
absolute_redirect off;"
fi
# Indent configurations
acl_configuration="$(indent "$acl_configuration" 4)"
additional_configuration="$(indent "$additional_configuration" 4)"
additional_configuration=$'\n'"$(indent "$additional_configuration" 4)"
http_listen_configuration="$(indent "$http_listen_configuration" 4)"
https_listen_configuration="$(indent "$https_listen_configuration" 4)"
# Render templates
@ -320,11 +322,11 @@ ensure_nginx_prefix_configuration_exists() {
local type=""
local allow_remote_connections="yes"
local var_name
local prefix="/${app}"
# Template variables defaults
export additional_configuration=""
export document_root="${BITNAMI_ROOT_DIR}/${app}"
export extra_directory_configuration=""
export prefix="/${app}"
# Validate arguments
shift
while [[ "$#" -gt 0 ]]; do
@ -350,11 +352,19 @@ ensure_nginx_prefix_configuration_exists() {
# ACL configuration
export acl_configuration=""
if ! is_boolean_yes "$allow_remote_connections"; then
acl_configuration=$'\n'"allow 127.0.0.1;"$'\n'"deny all;"
acl_configuration="
default_type text/html;
if (\$remote_addr != 127.0.0.1) {
return 403 'For security reasons, this URL is only accessible using localhost (127.0.0.1) as the hostname.';
}
# Avoid absolute redirects when connecting through a SSH tunnel
absolute_redirect off;"
fi
# Prefix configuration
export location="$prefix"
# Indent configurations
acl_configuration="$(indent "$acl_configuration" 4)"
additional_configuration="$(indent "$additional_configuration" 4)"
additional_configuration=$'\n'"$(indent "$additional_configuration" 4)"
# Render templates
# We remove lines that are empty or contain only newspaces with 'sed', so the resulting file looks better
local template_name="app"
@ -430,8 +440,8 @@ nginx_update_app_configuration() {
[[ -z "${https_listen_configuration:-}" ]] && https_listen_configuration="$https_listen" || https_listen_configuration="${https_listen_configuration}"$'\\\n'"${https_listen}"
done
else
http_listen_configuration="listen ${http_port};"
https_listen_configuration="listen ${https_port} ssl;"
http_listen_configuration="listen ${http_port} default_server;"
https_listen_configuration="listen ${https_port} ssl default_server;"
fi
# Indent configurations
http_listen_configuration="$(indent "$http_listen_configuration" 4)"

View File

@ -26,9 +26,7 @@ location ~ \.php$ {
fastcgi_read_timeout 300;
fastcgi_pass ${fastcgi_pass};
fastcgi_index index.php;
fastcgi_split_path_info ^(.+?\.php)(|/.*)\$;
fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
fastcgi_param PATH_INFO \$fastcgi_path_info;
fastcgi_param SCRIPT_FILENAME \$request_filename;
include fastcgi_params;
}
EOF

View File

@ -1,4 +1,4 @@
location {{prefix}} {
location {{location}} {
alias "{{document_root}}";
{{acl_configuration}}

View File

@ -1,4 +1,4 @@
location {{prefix}} {
location {{location}} {
alias "{{document_root}}";
{{acl_configuration}}

View File

@ -32,6 +32,9 @@ nginx_patch_httpoxy_vulnerability() {
# Load NGINX environment variables
. /opt/bitnami/scripts/nginx-env.sh
# Remove unnecessary directories that come with the tarball
rm -rf "${BITNAMI_ROOT_DIR}/certs" "${BITNAMI_ROOT_DIR}/server_blocks"
# Ensure non-root user has write permissions on a set of directories
for dir in "$NGINX_VOLUME_DIR" "$NGINX_CONF_DIR" "$NGINX_SERVER_BLOCKS_DIR" "${NGINX_CONF_DIR}/bitnami" "$NGINX_LOGS_DIR" "$NGINX_TMP_DIR"; do
ensure_dir_exists "$dir"

View File

@ -41,7 +41,7 @@ Learn more about the Bitnami tagging policy and the difference between rolling t
* [`9-debian-10`, `9.0.2-debian-10-r17`, `9`, `9.0.2`, `latest` (9/debian-10/Dockerfile)](https://github.com/bitnami/bitnami-docker-drupal-nginx/blob/9.0.2-debian-10-r17/9/debian-10/Dockerfile)
* [`8-debian-10`, `8.9.2-debian-10-r15`, `8`, `8.9.2` (8/debian-10/Dockerfile)](https://github.com/bitnami/bitnami-docker-drupal-nginx/blob/8.9.2-debian-10-r15/8/debian-10/Dockerfile)
* [`8-debian-10`, `8.9.2-debian-10-r16`, `8`, `8.9.2` (8/debian-10/Dockerfile)](https://github.com/bitnami/bitnami-docker-drupal-nginx/blob/8.9.2-debian-10-r16/8/debian-10/Dockerfile)
Subscribe to project updates by watching the [bitnami/drupal-nginx GitHub repo](https://github.com/bitnami/bitnami-docker-drupal-nginx).