Bug 14107 - zarafa webaccess is inaccessible
Summary: zarafa webaccess is inaccessible
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: 4
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: Thomas Spuhler
QA Contact:
URL: https://bugs.mageia.org/show_bug.cgi?...
Whiteboard: MGA4ONLY
Keywords:
Depends on:
Blocks:
 
Reported: 2014-09-17 15:09 CEST by claire robinson
Modified: 2015-02-16 23:33 CET (History)
1 user (show)

See Also:
Source RPM: zarafa
CVE:
Status comment:


Attachments

Description claire robinson 2014-09-17 15:09:50 CEST
Discovered during QA of a zarafa update in bug 13822

http://localhost/webaccess is initially 403 Forbidden and then blank.

Adding 'Require all granted' into /etc/httpd/conf/sites.d/zarafa-webaccess.conf like so..

<Directory /usr/share/zarafa-webaccess/>
    Require all granted
    # Some apache settings

..allows access but just shows a blank page.

/var/log/httpd/access_log shows it's returning a 500 error.

127.0.0.1 - - [17/Sep/2014:13:53:01 +0100] "GET /webaccess/ HTTP/1.1" 500 - "-" "Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Firefox/24.0"

Reproducible: 

Steps to Reproduce:
Comment 1 claire robinson 2014-09-17 16:04:15 CEST
Mga3 is also the same. As you said, it's likely never worked. Setting as a Cauldron bug. As that was also missing the 'Require all granted' or similar to allow apache access to /usr/share/zarafa-webaccess/ so is highly likely to be also broken.

Whiteboard: (none) => MGA4TOO MGA3TOO
Hardware: i586 => All
Version: 4 => Cauldron

Comment 2 Thomas Spuhler 2014-09-17 16:59:23 CEST
(In reply to claire robinson from comment #0)
> Discovered during QA of a zarafa update in bug 13822
> 
> http://localhost/webaccess is initially 403 Forbidden and then blank.
> 
> Adding 'Require all granted' into
> /etc/httpd/conf/sites.d/zarafa-webaccess.conf like so..
> 
> <Directory /usr/share/zarafa-webaccess/>
>     Require all granted
>     # Some apache settings
> 
> ..allows access but just shows a blank page.
> 
> /var/log/httpd/access_log shows it's returning a 500 error.
> 
> 127.0.0.1 - - [17/Sep/2014:13:53:01 +0100] "GET /webaccess/ HTTP/1.1" 500 -
> "-" "Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Firefox/24.0"
> 
> Reproducible: 
> 
> Steps to Reproduce:

This should have been take care of. WE have

<Directory /usr/share/zarafa-webaccess/>
    # Some apache settings
    DirectoryIndex index.php
    Options -Indexes +FollowSymLinks

    <IfModule mod_authz_core.c>
        # Apache 2.4
        Require all granted
    </IfModule>
    <IfModule !mod_authz_core.c>
        # Apache 2.2
        Order allow,deny
        Allow from all
    </IfModule>

Did you a new install or an upgrade?
Comment 3 claire robinson 2014-09-17 17:22:47 CEST
I haven't tested cauldron at all Thomas. Reset to mga4 if it's fixed there now.
Comment 4 Thomas Spuhler 2014-09-17 17:48:14 CEST
(In reply to claire robinson from comment #3)
> I haven't tested cauldron at all Thomas. Reset to mga4 if it's fixed there
> now.

It's the same for mga3 and mga4. It's part of the source from upstream
Comment 5 claire robinson 2014-09-17 17:52:21 CEST
As in bug 13822 it's clearly not right.

# cat /etc/httpd/conf/sites.d/zarafa-webaccess.conf
#
# Zarafa Webaccess featuring a 'Look & Feel' similar to Outlook
#

Alias /webaccess /usr/share/zarafa-webaccess/

# Following Apache and PHP settings need to be set to work correct
#
<Directory /usr/share/zarafa-webaccess/>
    # Some apache settings
    Options -Indexes +FollowSymLinks

    # Register globals must be off
    php_flag register_globals off

    # Magic quotes must be off
    php_flag magic_quotes_gpc off
    php_flag magic_quotes_runtime off

    # The maximum POST limit. To upload large files, this value must
    # be larger than upload_max_filesize.
    php_value post_max_size 31M
    php_value upload_max_filesize 30M

    # Short open tags must be on
    php_flag short_open_tag on

    # Uncomment for debugging purposes only. Make sure Apache/PHP can
    # write to this file or no errors will be logged!
#    php_flag log_errors on
#    php_value error_log /var/lib/zarafa-webaccess/error_log
</Directory>
Comment 6 Thomas Spuhler 2015-01-10 18:10:47 CET
There is a security issue with this package, Bug 14993
If upstream doesn't respond with a fix, we may retire it as Fedora did.

Status: NEW => ASSIGNED

Comment 7 Thomas Spuhler 2015-01-15 18:52:11 CET
Solved in cauldron and mga3
Obsoleted zarafa in cauldron and mga3 is EOL

Version: Cauldron => 4
Whiteboard: MGA4TOO MGA3TOO => MGA4ONLY

Comment 8 Robert Scheck 2015-01-21 02:36:43 CET
When looking through zarafa-webaccess-7.1.11-7.mga5.noarch.rpm it feels to
me like the removal of bundled libraries was not done properly, some removed
files are still referenced. The following two URLs might help you:

 - http://pkgs.fedoraproject.org/cgit/zarafa.git/tree/zarafa-7.1.11-php-unbundle.patch?id=07cc7867537d78ea274413b6b2f451f97a61a8e0
 - http://pkgs.fedoraproject.org/cgit/zarafa.git/commit/?id=07cc7867537d78ea274413b6b2f451f97a61a8e0

Note that I do not run Mageia here, just stumbled over bug #14993 and thus I
am now trying to help here. Just let me know if it doesn't do the trick.

CC: (none) => mageia.org

Comment 9 Thomas Spuhler 2015-02-16 23:33:54 CET
I believe this has been resolved Bug 14993

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.