diff --git a/bitnami/moodle/5.2/debian-12/Dockerfile b/bitnami/moodle/5.2/debian-12/Dockerfile index bd1aae37ba10..0ce59e27e96e 100644 --- a/bitnami/moodle/5.2/debian-12/Dockerfile +++ b/bitnami/moodle/5.2/debian-12/Dockerfile @@ -9,7 +9,7 @@ ARG TARGETARCH ARG WITH_ALL_LOCALES="no" LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \ - org.opencontainers.image.created="2026-05-26T19:15:45Z" \ + org.opencontainers.image.created="2026-05-31T00:30:52Z" \ org.opencontainers.image.description="Application packaged by Broadcom, Inc." \ org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/moodle/README.md" \ org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/moodle" \ @@ -30,7 +30,7 @@ RUN --mount=type=secret,id=downloads_url,env=SECRET_DOWNLOADS_URL \ mkdir -p /tmp/bitnami/pkg/cache/ ; cd /tmp/bitnami/pkg/cache/ || exit 1 ; \ COMPONENTS=( \ "render-template-1.0.9-165-linux-${OS_ARCH}-debian-12" \ - "php-8.4.21-3-linux-${OS_ARCH}-debian-12" \ + "php-8.4.21-5-linux-${OS_ARCH}-debian-12" \ "apache-2.4.67-1-linux-${OS_ARCH}-debian-12" \ "postgresql-client-14.23.0-0-linux-${OS_ARCH}-debian-12" \ "mysql-client-12.2.2-0-linux-${OS_ARCH}-debian-12" \ @@ -67,7 +67,7 @@ ENV APACHE_HTTPS_PORT_NUMBER="" \ APACHE_HTTP_PORT_NUMBER="" \ APP_VERSION="5.2.0" \ BITNAMI_APP_NAME="moodle" \ - IMAGE_REVISION="9" \ + IMAGE_REVISION="10" \ LANG="en_US.UTF-8" \ LANGUAGE="en_US:en" \ LD_LIBRARY_PATH="/opt/bitnami/postgresql/lib:$LD_LIBRARY_PATH" \ diff --git a/bitnami/moodle/5.2/debian-12/prebuildfs/opt/bitnami/checksums/php-8.4.21-3-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/moodle/5.2/debian-12/prebuildfs/opt/bitnami/checksums/php-8.4.21-3-linux-amd64-debian-12.tar.gz.sha256 deleted file mode 100644 index c137c576f886..000000000000 --- a/bitnami/moodle/5.2/debian-12/prebuildfs/opt/bitnami/checksums/php-8.4.21-3-linux-amd64-debian-12.tar.gz.sha256 +++ /dev/null @@ -1 +0,0 @@ -44db7e8074230f78383ce1d7fb574de6582abd2dd1b165bf3242c30488b81ef9 php-8.4.21-3-linux-amd64-debian-12.tar.gz diff --git a/bitnami/moodle/5.2/debian-12/prebuildfs/opt/bitnami/checksums/php-8.4.21-3-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/moodle/5.2/debian-12/prebuildfs/opt/bitnami/checksums/php-8.4.21-3-linux-arm64-debian-12.tar.gz.sha256 deleted file mode 100644 index 4046f911e1f7..000000000000 --- a/bitnami/moodle/5.2/debian-12/prebuildfs/opt/bitnami/checksums/php-8.4.21-3-linux-arm64-debian-12.tar.gz.sha256 +++ /dev/null @@ -1 +0,0 @@ -d10e7ae7a869247603e6e0c1028a2057353d14fb9e3ebc8449c8a358724d29e3 php-8.4.21-3-linux-arm64-debian-12.tar.gz diff --git a/bitnami/moodle/5.2/debian-12/prebuildfs/opt/bitnami/checksums/php-8.4.21-5-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/moodle/5.2/debian-12/prebuildfs/opt/bitnami/checksums/php-8.4.21-5-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..e6b37c12a0ea --- /dev/null +++ b/bitnami/moodle/5.2/debian-12/prebuildfs/opt/bitnami/checksums/php-8.4.21-5-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +101267a9e206d18be90a2bd1fc383a168359c96e1db7f7383d31a7366f1137fd php-8.4.21-5-linux-amd64-debian-12.tar.gz diff --git a/bitnami/moodle/5.2/debian-12/prebuildfs/opt/bitnami/checksums/php-8.4.21-5-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/moodle/5.2/debian-12/prebuildfs/opt/bitnami/checksums/php-8.4.21-5-linux-arm64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..f18b6e839e8d --- /dev/null +++ b/bitnami/moodle/5.2/debian-12/prebuildfs/opt/bitnami/checksums/php-8.4.21-5-linux-arm64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +73d961f31f79364d8c10385e3f2a918fc5b7e8bb4150cbdf11063a1ed60fde9a php-8.4.21-5-linux-arm64-debian-12.tar.gz diff --git a/bitnami/moodle/5.2/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh b/bitnami/moodle/5.2/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh index 1337f6c2dd59..b16efabd3230 100644 --- a/bitnami/moodle/5.2/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh +++ b/bitnami/moodle/5.2/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh @@ -131,6 +131,7 @@ relativize() { # -d|--dir-mode - mode for files. # -u|--user - user # -g|--group - group +# -n|--no-dereference - do not follow symlinks (use for runtime root chown of daemon-writable dirs) # Returns: # None ######################### @@ -140,6 +141,7 @@ configure_permissions_ownership() { local file_mode="" local user="" local group="" + local follow_symlinks="yes" # Validate arguments shift 1 @@ -161,6 +163,9 @@ configure_permissions_ownership() { shift group="${1:?missing group}" ;; + -n | --no-dereference) + follow_symlinks="no" + ;; *) echo "Invalid command line flag $1" >&2 return 1 @@ -169,22 +174,29 @@ configure_permissions_ownership() { shift done + # -L: follow symlinks and emits the target path + # This is dangerous at runtime, given a co-located lower-privileged process with write access + # to the target path can redirect the chown/chmod to arbitrary paths. Example: + # Lower-privileged process run: ln -s /etc /tmp/etc + # Then, setup.sh runs: configure_permissions_ownership --dir-mode 775 /tmp + local find_L_flag=(); [[ "$follow_symlinks" == "yes" ]] && find_L_flag=("-L") + # -h: changes symlink inode ownership without touching the target. + local chown_flags=(); [[ "$follow_symlinks" == "no" ]] && chown_flags=("-h") read -r -a filepaths <<<"$paths" for p in "${filepaths[@]}"; do if [[ -e "$p" ]]; then - find -L "$p" -printf "" if [[ -n $dir_mode ]]; then - find -L "$p" -type d ! -perm "$dir_mode" -print0 | xargs -r -0 chmod "$dir_mode" + find "${find_L_flag[@]}" "$p" -not -type l -type d ! -perm "$dir_mode" -print0 | xargs -r -0 chmod "$dir_mode" fi if [[ -n $file_mode ]]; then - find -L "$p" -type f ! -perm "$file_mode" -print0 | xargs -r -0 chmod "$file_mode" + find "${find_L_flag[@]}" "$p" -not -type l -type f ! -perm "$file_mode" -print0 | xargs -r -0 chmod "$file_mode" fi if [[ -n $user ]] && [[ -n $group ]]; then - find -L "$p" -print0 | xargs -r -0 chown "${user}:${group}" + find "${find_L_flag[@]}" "$p" -print0 | xargs -r -0 chown "${chown_flags[@]}" "${user}:${group}" elif [[ -n $user ]] && [[ -z $group ]]; then - find -L "$p" -print0 | xargs -r -0 chown "${user}" + find "${find_L_flag[@]}" "$p" -print0 | xargs -r -0 chown "${chown_flags[@]}" "${user}" elif [[ -z $user ]] && [[ -n $group ]]; then - find -L "$p" -print0 | xargs -r -0 chgrp "${group}" + find "${find_L_flag[@]}" "$p" -print0 | xargs -r -0 chgrp "${chown_flags[@]}" "${group}" fi else stderr_print "$p does not exist" diff --git a/bitnami/moodle/5.2/debian-12/rootfs/opt/bitnami/scripts/apache/bitnami-templates/bitnami-ssl.conf.tpl b/bitnami/moodle/5.2/debian-12/rootfs/opt/bitnami/scripts/apache/bitnami-templates/bitnami-ssl.conf.tpl index ff6de13a321e..a830382f2dd3 100644 --- a/bitnami/moodle/5.2/debian-12/rootfs/opt/bitnami/scripts/apache/bitnami-templates/bitnami-ssl.conf.tpl +++ b/bitnami/moodle/5.2/debian-12/rootfs/opt/bitnami/scripts/apache/bitnami-templates/bitnami-ssl.conf.tpl @@ -5,9 +5,11 @@ Listen 443 -SSLProtocol all -SSLv2 -SSLv3 -SSLHonorCipherOrder on -SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !EDH !RC4" +SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 +# Ciphers for TLS 1.2, see https://wiki.mozilla.org/Security/Server_Side_TLS +SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 +SSLHonorCipherOrder off +SSLSessionTickets off SSLPassPhraseDialog builtin SSLSessionCache "shmcb:{{APACHE_LOGS_DIR}}/ssl_scache(512000)" SSLSessionCacheTimeout 300 diff --git a/bitnami/moodle/5.2/debian-12/rootfs/opt/bitnami/scripts/libmoodle.sh b/bitnami/moodle/5.2/debian-12/rootfs/opt/bitnami/scripts/libmoodle.sh index d48cb965b976..e4fff8bf2872 100644 --- a/bitnami/moodle/5.2/debian-12/rootfs/opt/bitnami/scripts/libmoodle.sh +++ b/bitnami/moodle/5.2/debian-12/rootfs/opt/bitnami/scripts/libmoodle.sh @@ -124,7 +124,7 @@ moodle_initialize() { for dir in "$MOODLE_VOLUME_DIR" "$MOODLE_DATA_DIR"; do ensure_dir_exists "$dir" # Use daemon:root ownership for compatibility when running as a non-root user - am_i_root && configure_permissions_ownership "$dir" -d "775" -f "664" -u "$WEB_SERVER_DAEMON_USER" -g "root" + am_i_root && configure_permissions_ownership "$dir" -d "775" -f "664" -u "$WEB_SERVER_DAEMON_USER" -g "root" -n done info "Trying to connect to the database server" diff --git a/bitnami/moodle/5.2/debian-12/rootfs/opt/bitnami/scripts/libmysqlclient.sh b/bitnami/moodle/5.2/debian-12/rootfs/opt/bitnami/scripts/libmysqlclient.sh index 054084de6928..1a3ae0d0dc67 100644 --- a/bitnami/moodle/5.2/debian-12/rootfs/opt/bitnami/scripts/libmysqlclient.sh +++ b/bitnami/moodle/5.2/debian-12/rootfs/opt/bitnami/scripts/libmysqlclient.sh @@ -1041,15 +1041,21 @@ mysql_client_extra_opts() { local -a opts=() local key value if is_boolean_yes "${DB_ENABLE_SSL:-no}"; then + ca_file="$(mysql_client_env_value "SSL_CA_FILE")" if [[ "$(mysql_client_flavor)" = "mysql" ]]; then - opts+=("--ssl-mode=REQUIRED") + if [[ -f "$ca_file " ]]; then + opts+=("--ssl-mode=VERIFY_CA") + else + opts+=("--ssl-mode=REQUIRED") + fi else opts+=("--ssl=TRUE") + [[ -f "$ca_file" ]] && opts+=("--ssl-verify-server-cert") fi - # Add "--ssl-ca", "--ssl-key" and "--ssl-cert" options if the env vars are defined + # Add "--ssl-ca", "--ssl-key" and "--ssl-cert" options if the env vars are defined and the files exist for key in ca key cert; do value="$(mysql_client_env_value "SSL_${key^^}_FILE")" - [[ -n "${value}" ]] && opts+=("--ssl-${key}=${value}") + [[ -f "${value}" ]] && opts+=("--ssl-${key}=${value}") done else # Skip SSL validation