Update to 2021-08-27 13:00

roles/dolibarr/defaults/main.yml

@@ -2,9 +2,9 @@
 
 dolibarr_id: 1
 dolibarr_manage_upgrade: True
-dolibarr_version: 13.0.3
+dolibarr_version: 14.0.1
 dolibarr_archive_url: https://downloads.sourceforge.net/project/dolibarr/Dolibarr%20ERP-CRM/{{ dolibarr_version }}/dolibarr-{{ dolibarr_version }}.tgz
-dolibarr_archive_sha1: 0cd4c215a8e8e6019535874905ba9dc377aa801b
+dolibarr_archive_sha1: f361352cc39d063726499d78f3ca512d9f04072d
 
 dolibarr_root_dir: /opt/dolibarr_{{ dolibarr_id }}
 dolibarr_php_user: php-dolibarr_{{ dolibarr_id }}

roles/dolibarr/files/dolibarr_token.patch

@@ -1,10 +1,10 @@
---- htdocs/main.inc.php.orig	2021-04-09 19:02:49.957818778 +0200
-+++ htdocs/main.inc.php	2021-04-21 18:10:31.597094173 +0200
-@@ -455,6 +455,7 @@
- 		}
+--- /opt/dolibarr_1/web/htdocs/main.inc.php.orig	2021-08-27 11:40:42.177502730 +0200
++++ /opt/dolibarr_1/web/htdocs/main.inc.php	2021-08-27 11:41:02.821219393 +0200
+@@ -507,6 +507,7 @@
  	}
  
+ 	$sessiontokenforthisurl = (empty($_SESSION['token']) ? '' : $_SESSION['token']);
 +	$_GET['token'] = $_SESSION['token']; // Tmp workaround for https://github.com/Dolibarr/dolibarr/issues/16096
- 	if (GETPOSTISSET('token') && GETPOST('token', 'alpha') != $_SESSION['token'])
- 	{
- 		dol_syslog("--- Access to ".$_SERVER["PHP_SELF"]." refused due to invalid token, so we disable POST and some GET parameters - referer=".$_SERVER['HTTP_REFERER'].", action=".GETPOST('action', 'aZ09').", _GET|POST['token']=".GETPOST('token', 'alpha').", _SESSION['token']=".$_SESSION['token'], LOG_WARNING);
+ 	// TODO Get the sessiontokenforthisurl into the array of session token
+ 	if (GETPOSTISSET('token') && GETPOST('token') != 'notrequired' && GETPOST('token', 'alpha') != $sessiontokenforthisurl) {
+ 		dol_syslog("--- Access to ".(empty($_SERVER["REQUEST_METHOD"])?'':$_SERVER["REQUEST_METHOD"].' ').$_SERVER["PHP_SELF"]." refused due to invalid token, so we disable POST and some GET parameters - referer=".$_SERVER['HTTP_REFERER'].", action=".GETPOST('action', 'aZ09').", _GET|POST['token']=".GETPOST('token', 'alpha').", _SESSION['token']=".$_SESSION['token'], LOG_WARNING);

roles/openxpki/defaults/main.yml

@@ -1,12 +1,12 @@
 ---
 
-pki_version: '3.10.1'
+pki_version: '3.14.4'
 pki_archive_url: https://github.com/openxpki/openxpki/archive/v{{ pki_version }}.tar.gz
-pki_archive_sha1: 396cc783369433f1fb0cded3bd36d690d8a13b69
+pki_archive_sha1: 1f2e1adc50ab61ec0a77feb7910bc49237afc8ba
 
-pki_config_version: '3.10'
+pki_config_version: '3.12'
 pki_config_archive_url: https://github.com/openxpki/openxpki-config/archive/v{{ pki_config_version }}.tar.gz
-pki_config_archive_sha1: 1abf078ecbb9752aecfa095a5d441e7685a19a5c
+pki_config_archive_sha1: 115db2522c7ca1657520a4bbc86d1940a76065bc
 
 # Should ansible handle updates or only initial install
 pki_manage_upgrade: True

roles/openxpki/files/upgrade_to_v3.14.sql

@@ -0,0 +1,9 @@
+ALTER TABLE `certificate`
+  DROP KEY `pki_realm_2`,
+  ADD KEY `pki_realm_req_key` (`pki_realm`,`req_key`),
+  ADD KEY `req_key` (`req_key`);
+
+ALTER TABLE `csr_attributes`
+  ADD KEY `pki_realm_req_key` (`pki_realm`,`req_key`);
+
+

roles/openxpki/tasks/install.yml

@@ -240,6 +240,7 @@
   loop:
     - '3.4'
     - '3.8'
+    - '3.14'
   tags: pki
 
 - name: Apply db upgrades
@@ -253,6 +254,7 @@
   loop:
     - '3.4'
     - '3.8'
+    - '3.14'
   when:
     - pki_install_mode == 'upgrade'
     - pki_current_version is version(item, '<')

roles/openxpki/templates/config.d/realm/auth/handler.yaml.j2

@@ -1,14 +1,14 @@
 {% for map in item.0.auth.role_map | sort(attribute='priority') %}
 LDAP Auth {{ map.role }}:
-  type: External
+  type: Command
   label: LDAP Authentication {{ map.role }}
   description: Authenticate {{ map.role }} against an LDAP server
   role: {{ map.role }}
-  command: {{ pki_root_dir }}/bin/openxpki-auth-ldap -H {{ item.0.auth.ldap_uri }} -b {{ item.0.auth.ldap_base }} {{ item.0.auth.ldap_start_tls | ternary('--starttls ','') }}-U LOGIN -P PASSWD --extra-filter='{{ map.filter }}' --user-attr={{ item.0.auth.ldap_user_attr }} {% if item.0.auth.ldap_bind_dn is defined and item.0.auth.ldap_bind_pass is defined %}-D BIND_DN -W BIND_PASS{% endif %} 
+  command: [ '{{ pki_root_dir }}/bin/openxpki-auth-ldap', '-H', '{{ item.0.auth.ldap_uri }}', '-b', '{{ item.0.auth.ldap_base }}', '{{ item.0.auth.ldap_start_tls | ternary('--starttls','') }}', '-U', 'LOGIN', '-P', 'PASSWD', '--extra-filter={{ map.filter }}', '--user-attr={{ item.0.auth.ldap_user_attr }}'{% if item.0.auth.ldap_bind_dn is defined and item.0.auth.ldap_bind_pass is defined %}, '-D', 'BIND_DN', '-W', 'BIND_PASS'{% endif %} ]
   env:
     PERL5LIB: {{ pki_root_dir }}/lib/perl5
-    LOGIN: __USER__
-    PASSWD: __PASSWD__
+    LOGIN: "[% username %]"
+    PASSWD: "[% password %]"
 {% if item.0.auth.ldap_bind_dn is defined and item.0.auth.ldap_bind_pass is defined %}
     BIND_DN: {{ item.0.auth.ldap_bind_dn }}
     BIND_PASS: '{{ item.0.auth.ldap_bind_pass }}'