Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild

by removing that dependency (RHBZ#2342582)

.gitignore

@@ -1,3 +1,10 @@
 websvn-2.3.1.tar.gz
 /websvn-2.3.2.tar.gz
 /websvn-2.3.3.tar.gz
+/websvn-2.5.tar.gz
+/websvn-2.6.0.tar.gz
+/websvn-2.6.1.tar.gz
+/websvn-2.7.0.tar.gz
+/websvn-2.8.1.tar.gz
+/websvn-2.8.2.tar.gz
+/websvn-2.8.4.tar.gz

sources

@@ -1 +1 @@
-bc1821caf77a3225aa810e8f19400ea6  websvn-2.3.3.tar.gz
+SHA512 (websvn-2.8.4.tar.gz) = 04eeb30c8b8e8b7d693a07d7857e41a50cf005c505a65ff05e2e27aea387d39163a8770e76532ff7c5aab73dc121fdd3008b4978fedd483ad3dd50b74a95d2d7

websvn-2.3.3-CVE-2013-6892.patch

@@ -1,31 +0,0 @@
-diff -ur oud/dl.php nieuw/dl.php
---- oud/dl.php	2015-01-18 16:03:30.688791512 +0100
-+++ nieuw/dl.php	2015-01-18 16:27:00.950897749 +0100
-@@ -137,6 +137,18 @@
- 		exit(0);
- 	}
- 
-+	// For security reasons, disallow direct downloads of filenames that
-+	// are a symlink, since they may be a symlink to anywhere (/etc/passwd)
-+	// Deciding whether the symlink is relative and legal within the
-+	// repository would be nice but seems to error prone at this moment.
-+	if ( is_link($tempDir.DIRECTORY_SEPARATOR.$archiveName) ) {
-+		header('HTTP/1.x 500 Internal Server Error', true, 500);
-+		error_log('to be downloaded file is symlink, aborting: '.$archiveName);
-+		print 'Download of symlinks disallowed: "'.xml_entities($archiveName).'".';
-+		removeDirectory($tempDir);
-+		exit(0);
-+	}
-+
- 	// Set timestamp of exported directory (and subdirectories) to timestamp of
- 	// the revision so every archive of a given revision has the same timestamp.
- 	$revDate = $logEntry->date;
-@@ -180,7 +192,7 @@
- 		$downloadMimeType = 'application/x-zip';
- 		$downloadArchive .= '.zip';
- 		// Create zip file
--		$cmd = $config->zip.' -r '.quote($downloadArchive).' '.quote($archiveName);
-+		$cmd = $config->zip.' --symlinks -r '.quote($downloadArchive).' '.quote($archiveName);
- 		execCommand($cmd, $retcode);
- 		if ($retcode != 0) {
- 			error_log('Unable to call zip command: '.$cmd);

websvn-2.3.3-CVE-2016-1236.patch

@@ -1,61 +0,0 @@
-Description: CVE-2016-1236: XSS via directory or file in a repository containing XSS payload
-Origin: vendor
-Forwarded: no
-Author: Nitin Venkatesh <venkatesh.nitin@gmail.com>
-Reviewed-by: Salvatore Bonaccorso <carnil@debian.org>
-Last-Update: 2016-05-08
-
---- a/revision.php
-+++ b/revision.php
-@@ -145,7 +145,7 @@ if ($rep) {
- 		}
- 		$resourceExisted = $change->action == 'M' || $change->copyfrom;
- 		$listing[] = array(
--			'path' => $change->path,
-+			'path' => escape($change->path),
- 			'oldpath' => $change->copyfrom ? $change->copyfrom.' @ '.$change->copyrev : '',
- 			'action' => $change->action,
- 			'added' => $change->action == 'A',
---- a/log.php
-+++ b/log.php
-@@ -323,6 +323,9 @@ if ($rep) {
- 					$listing[$index]['revadded'] = (isset($modpaths['A'])) ? implode('<br/>', $modpaths['A']) : '';
- 					$listing[$index]['revdeleted'] = (isset($modpaths['D'])) ? implode('<br/>', $modpaths['D']) : '';
- 					$listing[$index]['revmodified'] = (isset($modpaths['M'])) ? implode('<br/>', $modpaths['M']) : '';
-+					$listing[$index]['revadded'] = escape($listing[$index]['revadded']);
-+					$listing[$index]['revdeleted'] = escape($listing[$index]['revdeleted']);
-+					$listing[$index]['revmodified'] = escape($listing[$index]['revmodified']);
- 				}
- 
- 				$row = 1 - $row;
---- a/comp.php
-+++ b/comp.php
-@@ -381,7 +381,7 @@ if ($rep) {
- 						$absnode .= $node;
- 					}
- 
--					$listing[$index]['newpath'] = $absnode;
-+					$listing[$index]['newpath'] = escape($absnode);
- 
- 					$listing[$index]['fileurl'] = $config->getURL($rep, $absnode, 'file').'rev='.$rev2;
- 
---- a/listing.php
-+++ b/listing.php
-@@ -123,7 +123,7 @@ function showDirFiles($svnrep, $subs, $l
- 				$listing[$index]['level'] = ($treeview) ? $level : 0;
- 				$listing[$index]['node'] = 0; // t-node
- 				$listing[$index]['path'] = $path.$file;
--				$listing[$index]['filename'] = $file;
-+				$listing[$index]['filename'] = escape($file);
- 				if ($isDir) {
- 					$listing[$index]['fileurl'] = urlForPath($path.$file, $passRevString);
- 				} else {
-@@ -137,7 +137,7 @@ function showDirFiles($svnrep, $subs, $l
- 				}
- 
- 				if ($treeview) {
--					$listing[$index]['compare_box'] = '<input type="checkbox" name="compare[]" value="'.$path.$file.'@'.$passrev.'" onclick="checkCB(this)" />';
-+					$listing[$index]['compare_box'] = '<input type="checkbox" name="compare[]" value="'.escape($path.$file).'@'.$passrev.'" onclick="checkCB(this)" />';
- 				}
- 				if ($config->showLastModInListing()) {
- 					$listing[$index]['committime'] = $entry->committime;

websvn-2.3.3-CVE-2016-2511.patch

@@ -1,11 +0,0 @@
---- orig/include/setup.php	2016-02-19 16:02:05.674756241 +0100
-+++ new/include/setup.php	2016-02-19 16:02:10.166832543 +0100
-@@ -467,7 +467,7 @@
- $vars['validationurl'] = getFullURL($_SERVER['SCRIPT_NAME']).'?'.buildQuery($queryParams + array('template' => $template, 'language' => $language), '%26');
- 
- // To avoid a possible XSS exploit, need to clean up the passed-in path first
--$path = !empty($_REQUEST['path']) ? $_REQUEST['path'] : null;
-+$path = !empty($_REQUEST['path']) ? escape($_REQUEST['path']) : null;
- if ($path === null || $path === '')
- 	$path = '/';
- $vars['safepath'] = escape($path);

websvn-2.3.3-use_system_libs.patch

@@ -1,33 +0,0 @@
-diff -Naur websvn-2.3.3.orig/include/svnlook.php websvn-2.3.3/include/svnlook.php
---- websvn-2.3.3.orig/include/svnlook.php	2011-06-27 11:12:51.000000000 +0200
-+++ websvn-2.3.3/include/svnlook.php	2011-06-28 21:36:43.000000000 +0200
-@@ -752,7 +752,7 @@
- 		foreach ($extGeshi as $language => $extensions) {
- 			if (in_array($filename, $extensions) || in_array($ext, $extensions)) {
- 				if ($this->geshi === null) {
--					require_once 'lib/geshi.php';
-+					require_once 'geshi.php';
- 					$this->geshi = new GeSHi();
- 				} else {
- 					$this->geshi->error = false;
-@@ -796,7 +796,7 @@
- 
- 		$source = file_get_contents($filename);
- 		if ($this->geshi === null) {
--			require_once 'lib/geshi.php';
-+			require_once 'geshi.php';
- 			$this->geshi = new GeSHi();
- 		}
- 		$this->geshi->set_source($source);
-diff -Naur websvn-2.3.3.orig/wsvn.php websvn-2.3.3/wsvn.php
---- websvn-2.3.3.orig/wsvn.php	2011-06-28 21:35:45.000000000 +0200
-+++ websvn-2.3.3/wsvn.php	2011-06-28 21:36:43.000000000 +0200
-@@ -45,7 +45,7 @@
- 	define('WSVN_MULTIVIEWS', 1);
- }
- 
--ini_set('include_path', $locwebsvnreal);
-+ini_set('include_path', ini_get('include_path').":".$locwebsvnreal);
- 
- require_once 'include/setup.php';
- require_once 'include/svnlook.php';

websvn-httpd.conf

@@ -1,8 +1,8 @@
 Alias /websvn /usr/share/websvn/
 
 <Directory /usr/share/websvn/>
-   Options MultiViews
-   DirectoryIndex wsvn.php
+   Options MultiViews FollowSymLinks
+   DirectoryIndex browse.php
    <IfModule mod_authz_core.c>
       # Apache 2.4
       Require local

websvn.spec

@@ -1,30 +1,30 @@
 Name:           websvn
-Version:        2.3.3
-Release:        23%{?dist}
+Version:        2.8.4
+Release:        7%{?dist}
 Summary:        Online subversion repository browser
 
-License:        GPLv2+
+License:        GPL-2.0-or-later
 URL:            https://websvnphp.github.io
-Source0:        http://websvn.tigris.org/files/documents/1380/49056/websvn-2.3.3.tar.gz
+Source0:        https://github.com/websvnphp/websvn/archive/%{version}/%{name}-%{version}.tar.gz
 Source1:        websvn-httpd.conf
-Patch1:         websvn-2.3.3-use_system_libs.patch
-# https://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=websvn_symlinks.patch;att=1;bug=775682
-Patch2:         websvn-2.3.3-CVE-2013-6892.patch
-Patch3:         websvn-2.3.3-CVE-2016-2511.patch
-Patch4:         websvn-2.3.3-CVE-2016-1236.patch
-Patch5:         websvn-2.3.3-geshi.patch
-Patch6:         websvn-2.3.3-fix_website_url.patch
+
 BuildArch:      noarch
 
 Requires(pre):  httpd
 Requires:       sed
 Requires:       enscript
-Requires:       php >= 4.3.0
+Requires:       php >= 5.4.0
 Requires:       php-mbstring
 Requires:       php-xml
 Requires:       php-geshi
 Requires:       php-pear(Archive_Tar)
+# Text_Diff is broken with PHP 8.
+# Use system diff instead where needed.
+%if 0%{?fedora} >= 35 || 0%{?rhel} >= 9
+Requires:       diffutils
+%else
 Requires:       php-pear(Text_Diff)
+%endif
 
 
 %description
@@ -48,27 +48,9 @@ SElinux context for %{name}.
 
 %prep
 %setup -q
-### Let websvn use the system provided php classes and remove bundled ones.
-%patch1 -p1
-rm -rf lib/
-# CVE-2013-6892
-%patch2 -p1
-# CVE-2016-2511
-%patch3 -p1
-# CVE-2016-1236.patch
-%patch4 -p1
-# geshi.patch
-%patch5 -p1
-# website url
-%patch6 -p1
+find -name .gitignore -delete
 
 mv include/distconfig.php include/config.php
-find templates/calm -type f -exec chmod -R a-x {} ';'
-sed -i -e 's/\r//' doc/style.css
-iconv -f iso8859-1 -t utf-8 changes.txt > changes.txt.conv \
-&& touch -r changes.txt changes.txt.conv \
-&& mv -f changes.txt.conv changes.txt
-sed -i -e "s#^\$locwebsvnhttp = '';#\$locwebsvnhttp = '/websvn';#" wsvn.php
 sed -i -e "s#^\/\/ \$config->useMultiViews();#\$config->useMultiViews();#" \
     include/config.php
 
@@ -78,8 +60,6 @@ sed -i -e "s#^\/\/ \$config->useMultiViews();#\$config->useMultiViews();#" \
 
 
 %install
-rm -rf $RPM_BUILD_ROOT
-
 # Install the code
 mkdir -p $RPM_BUILD_ROOT/%{_datadir}/%{name}
 cp -a *.php include javascript languages templates \
@@ -106,6 +86,9 @@ ln -s ../../..%{_localstatedir}/cache/%{name} \
 mkdir -p $RPM_BUILD_ROOT/%{_localstatedir}/tmp
 ln -s ../../..%{_localstatedir}/tmp $RPM_BUILD_ROOT/%{_datadir}/%{name}/temp
 
+# Add a compat symlink from removed wsvn.php to new browse.php
+# This needs FollowSymlinks option in the httpd conf
+ln -s %{_datadir}/%{name}/browse.php %{buildroot}/%{_datadir}/%{name}/wsvn.php
 
 
 %post selinux
@@ -120,7 +103,8 @@ fi
 
 
 %files
-%doc changes.txt license.txt doc/
+%doc README.md changes.txt
+%license license.txt
 %config(noreplace) %{_sysconfdir}/httpd/conf.d/%{name}.conf
 %config(noreplace) %{_sysconfdir}/%{name}/config.php
 %{_datadir}/%{name}
@@ -131,6 +115,75 @@ fi
 
 
 %changelog
+* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.4-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
+
+* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.4-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
+
+* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.4-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Mon Feb 03 2025 Christian Krause <chkr@fedoraproject.org> - 2.8.4-4
+- Fix FailsToInstall in F42 due to orphaned package (php-erusev-parsedown)
+  by removing that dependency (RHBZ#2342582)
+
+* Sun Jan 19 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.4-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.4-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Tue Jun 18 2024 Christian Krause <chkr@fedoraproject.org> - 2.8.4-1
+- Update to 2.8.4 (RHBZ#2255355)
+- Delete .gitignore files from source directory
+
+* Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.2-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Mon Jun 26 2023 Xavier Bachelot <xavier@bachelot.org> - 2.8.2-1
+- Update to 2.8.2 (RHBZ#2215709)
+
+* Wed Jun 07 2023 Xavier Bachelot <xavier@bachelot.org> - 2.8.1-1
+- Update to 2.8.1 (RHBZ#2134251)
+- Convert License: to SPDX
+
+* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.0-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Fri Mar 18 2022 Xavier Bachelot <xavier@bachelot.org> - 2.7.0-1
+- Update to 2.7.0 (RHBZ#2064103)
+
+* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.1-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Thu Sep 09 2021 Xavier Bachelot <xavier@bachelot.org> - 2.6.1-3
+- Use system diff rather than Text_Diff with PHP 8
+
+* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Mon May 17 2021 Xavier Bachelot <xavier@bachelot.org> - 2.6.1-1
+- Update to 2.6.1 (RHBZ#1960100)
+
+* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Mon Nov 30 2020 Xavier Bachelot <xavier@bachelot.org> - 2.6.0-1
+- Update to 2.6.0 (RHBZ#1893501)
+
+* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.5-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Fri Jul 10 2020 Xavier Bachelot <xavier@bachelot.org> 2.5-1
+- Update to 2.5
+
 * Fri Jul 10 2020 Xavier Bachelot <xavier@bachelot.org> 2.3.3-23
 - Better website URL fix