redmine_audit 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 182a256634fc3c05360c058215fa5c0bdef09bc1
-  data.tar.gz: 2619e900354882da15f5e6775552ee95e2d68168
+  metadata.gz: 1bb3b023e6550d3fc79de999b8e0244ce5d4b2d4
+  data.tar.gz: b11e7bd9c26bfb3302ee96da910b6a4d4df913f6
 SHA512:
-  metadata.gz: 50b2639203a7c5540b3cee8d85e71ae67914dbb4137f02c803e9303c0374b3b982d2554bbff43b24632d5ca9c6ef53b597553eb8cc0da909ad6222e83eaa2a09
-  data.tar.gz: 4b273431a5b814f7b9d63a7d256f60a8b05026dad18fe35a7d916ad9f7c1c84fe63750089e1bd339d5720eb10aa51773c750fb081ea03ca30f8911447a3d06e6
+  metadata.gz: 71852521e605ddfcb0825f76417d7a4c2494cd12a1adcdfc23917fd6f16e79b2c10cc36cf3d5054493424b65b3e5c200e0aa81c9ebc76df23f3c165937de41a4
+  data.tar.gz: 57ad5479a04476b5629b9887c3d6a5087224ca6b59022a2c5ab5d685c19a064edaaad4fc5c8017e5275f75a99a7d95424da53990fb9abd44a3fde5989e404505

data/.gitignore

@@ -1 +1,2 @@
+/pkg
 Gemfile.lock

data/README.md

@@ -14,6 +14,22 @@ And then execute:
 
     $ bundle
 
+Or git clone under Redmine's plugins directory.
+
+```
+$ cd /path/to/redmine/plugins && git clone https://github.com/sho-h/redmine_audit.git
+```
+
+## Uninstallation
+
+Remove above line from your Redmine's Gemfile.local.
+
+And remove file(s) this gem installed(or you cloned).
+
+```
+$ cd /path/to/redmine/plugins && rm -rf ./redmine_audit
+```
+
 ## Usage
 
 Excecute redmine:audit rake task with users environment variable.
@@ -25,10 +41,10 @@ $ rake redmine:audit users=1,2 RAILS_ENV=production
 Or, add same commant to crontab.
 
 ```
-30 6 * * * www-data cd /path/to/redmine ; rake redmine:audit users=1,2 RAILS_ENV=production
+30 6 * * * www-data perl -e 'sleep int(rand(3600))' && cd /path/to/redmine ; rake redmine:audit users=1,2 RAILS_ENV=production
 ```
 
-users environment variable can set only system administrator.
+Send email if vulnerabilities found. users environment variable can set only system administrator.
 
 ## Contributing
 

data/app/models/mailer.rb

@@ -6,7 +6,7 @@ class Mailer < ActionMailer::Base
   #   The version to compare against {#unaffected_versions}.
   # @param [Array] user_ids
   #   Array of user ids who should be notified
-  def unfixed_advisories_found(advisories, user_ids)
+  def unfixed_advisories_found(redmine_version, advisories, user_ids)
     if advisories.nil? || advisories.empty?
       raise "Couldn't find user specified: #{advisories.inspect}"
     end
@@ -16,6 +16,7 @@ class Mailer < ActionMailer::Base
       raise ActiveRecord::RecordNotFound.new("Couldn't find user specified: #{user_ids.inspect}")
     end
 
+    @redmine_version = redmine_version
     @advisories = advisories
     # TODO: Internationalize suject and body.
     mail(to: users, subject: "[Redmine] Security notification")

data/app/views/mailer/unfixed_advisories_found.html.erb

@@ -12,6 +12,8 @@
 
 <div>
   <ul style="list-style:none;">
+    <li>Name: Redmine</li>
+    <li>Version: <%= @redmine_version %></li>
     <li>Severity: <%= advisory.severity %></li>
     <li>URL: <%= ext_refs %></li>
     <li>Detail: <%= advisory.details %></li>

data/app/views/mailer/unfixed_advisories_found.text.erb

@@ -10,6 +10,8 @@
   solution = advisory.fixed_versions.join(', ')
 -%>
 
+Name: Redmine
+Version: <%= @redmine_version %>
 Severity: <%= advisory.severity %>
 URL: <%= ext_refs %>
 Detail: <%= advisory.details %>

data/lib/redmine_audit.rb

@@ -5,6 +5,29 @@ module RedmineAudit
   class Plugin < ::Rails::Engine
     config.after_initialize do
       require File.expand_path('../init', __dir__)
+
+      create_hint = true
+      # TODO: support Redmine 3.4.0
+      plugins_dir = File.join(Bundler.root, 'plugins')
+      Dir.glob(File.join(plugins_dir, '*/redmine_audit.gemspec')) do |gemspec_path|
+        Rails.logger.warn('Skip to load redmine_audit plugin installed as gem.')
+        Rails.logger.warn('Use plugins directory\'s redmine_audit plugin')
+        create_hint = false
+      end
+
+      if create_hint
+        # Create text file to Redmine's plugins directory.
+        # The purpose is telling plugins directory to users.
+        path = File.join(plugins_dir, 'redmine_audit')
+        if !File.exists?(path)
+          File.open(path, 'w') do |f|
+            f.write(<<EOS)
+This plugin was installed as gem wrote to Gemfile.local instead of putting Redmine's plugin directory.
+See redmine_audit gem installed directory.
+EOS
+          end
+        end
+      end
     end
   end
 end

data/lib/redmine_audit/database.rb

@@ -57,7 +57,9 @@ module RedmineAudit
       # Ignore depends gem
       return nil if /Ruby on Rails vulnerability/.match(res[1])
 
-      versions = tds[4].content.split(/\s*(?:and|,)\s*/)
+      versions = tds[4].content.split(/\s*(?:and|,)\s*/).sort {|v1, v2|
+        Gem::Version.new(v1) <=> Gem::Version.new(v2)
+      }
       fixed_versions = []
       if versions.length > 1
         fixed_versions =

data/lib/redmine_audit/version.rb

@@ -1,3 +1,3 @@
 module RedmineAudit
-  VERSION = '0.1.0'
+  VERSION = '0.1.1'
 end

data/lib/tasks/redmine_audit.rake

@@ -13,17 +13,21 @@ Example:
 END_DESC
 
 namespace :redmine do
-  task audit: :environment do
-    # TODO: More better if requires mailer automatically.
-    require_dependency 'mailer'
-    require_relative '../../app/models/mailer.rb'
+  # Avoid to define same task twice.
+  # TODO: stop load twice this .rake file.
+  if !Rake::Task.task_defined?(:audit)
+    task audit: :environment do
+      # TODO: More better if requires mailer automatically.
+      require_dependency 'mailer'
+      require_relative '../../app/models/mailer.rb'
 
-    redmine_ver = Redmine::VERSION
-    advisories = RedmineAudit::Database.new.advisories(redmine_ver.to_s)
-    if advisories.length > 0
-      users = (ENV['users'] || '').split(',').each(&:strip!)
-      Mailer.with_synched_deliveries do
-        Mailer.unfixed_advisories_found(advisories, users).deliver
+      redmine_ver = Redmine::VERSION
+      advisories = RedmineAudit::Database.new.advisories(redmine_ver.to_s)
+      if advisories.length > 0
+        users = (ENV['users'] || '').split(',').each(&:strip!)
+        Mailer.with_synched_deliveries do
+          Mailer.unfixed_advisories_found(redmine_ver, advisories, users).deliver
+        end
       end
     end
   end

data/redmine_audit.gemspec

@@ -9,13 +9,13 @@ Gem::Specification.new do |spec|
   spec.authors       = ['Sho Hashimoto']
   spec.email         = ['sho.hsmt@gmail.com']
 
-  spec.summary       = %q{Redmine plugin for checking vulnerabilities}
-  spec.description   = %q{Redmine plugin for checking vulnerabilities}
+  spec.summary       = %q{Redmine plugin for checking Redmine's own vulnerabilities}
+  spec.description   = %q{Redmine plugin for checking Redmine's own vulnerabilities}
   spec.homepage      = 'https://github.com/sho-h/redmine_audit'
   spec.license       = 'MIT'
 
   spec.files         = `git ls-files -z`.split("\x0").reject do |f|
-    f.match(%r{^(test|spec|features)/})
+    f.match(%r{^((test|spec|features)/|Gemfile)})
   end
   spec.bindir        = 'exe'
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: redmine_audit
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Sho Hashimoto
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2017-06-12 00:00:00.000000000 Z
+date: 2017-06-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nokogiri
@@ -80,7 +80,7 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description: Redmine plugin for checking vulnerabilities
+description: Redmine plugin for checking Redmine's own vulnerabilities
 email:
 - sho.hsmt@gmail.com
 executables: []
@@ -88,7 +88,6 @@ extensions: []
 extra_rdoc_files: []
 files:
 - ".gitignore"
-- Gemfile
 - LICENSE
 - README.md
 - Rakefile
@@ -136,5 +135,5 @@ rubyforge_project:
 rubygems_version: 2.5.2
 signing_key: 
 specification_version: 4
-summary: Redmine plugin for checking vulnerabilities
+summary: Redmine plugin for checking Redmine's own vulnerabilities
 test_files: []

data/Gemfile

@@ -1,4 +0,0 @@
-source 'https://rubygems.org'
-
-# Specify your gem's dependencies in redmine_audit.gemspec
-gemspec