Even more security fixes (and other minor things)

.github/container/Dockerfile

@@ -19,7 +19,7 @@ RUN go install -v \
 FROM docker.io/erlang:${OTP_VSN}-alpine AS ejabberd
 
 RUN apk -U add --no-cache \
-        nodejs npm ca-certificates \
+        ca-certificates \
         autoconf \
         automake \
         bash \
@@ -33,6 +33,7 @@ RUN apk -U add --no-cache \
         libpng-dev \
         libwebp-dev \
         linux-pam-dev \
+        npm \
         openssl-dev \
         sqlite-dev \
         yaml-dev \
@@ -54,15 +55,6 @@ COPY / $BUILD_DIR/
 
 WORKDIR $BUILD_DIR
 
-RUN npm init -y \
-    && npm install --silent jquery@3.7.1 bootstrap@4.6.2 \
-    && mkdir -p /rootfs/usr/share/javascript/bootstrap4/css \
-    && mkdir -p /rootfs/usr/share/javascript/bootstrap4/js \
-    && mkdir -p /rootfs/usr/share/javascript/jquery/ \
-    && cp -r node_modules/bootstrap/dist/css/bootstrap.min* /rootfs/usr/share/javascript/bootstrap4/css \
-    && cp -r node_modules/bootstrap/dist/js/bootstrap.min* /rootfs/usr/share/javascript/bootstrap4/js \
-    && cp -r node_modules/jquery/dist/jquery.min* /rootfs/usr/share/javascript/jquery/
-
 RUN mv .github/container/ejabberdctl.template . \
     && mv .github/container/ejabberd.yml.example . \
     && ./autogen.sh \

.gitignore

@@ -47,3 +47,6 @@ Mnesia.nonode@nohost/
 /ejabberd-*.rpm
 /ejabberd-*.run
 /ejabberd-*.tar.gz
+/priv/mod_invites/static/bootstrap/
+/priv/mod_invites/static/jquery/
+/node_modules/

Makefile.in

@@ -212,7 +212,7 @@ endif
 
 all: scripts deps src
 
-deps: $(DEPSDIR)/.got
+deps: $(DEPSDIR)/.got invites-deps
 
 $(DEPSDIR)/.got:
 	rm -rf $(DEPSDIR)/.got
@@ -224,6 +224,15 @@ $(DEPSDIR)/.got:
 $(DEPSDIR)/.built: $(DEPSDIR)/.got
 	$(REBAR) compile && :> $(DEPSDIR)/.built
 
+ifeq (, $(shell which npm))
+  INSTALL_INVITES_DEPS=tools/dl_invites_page_deps.sh priv/mod_invites/static
+else
+  INSTALL_INVITES_DEPS=npm install
+endif
+
+invites-deps:
+	$(INSTALL_INVITES_DEPS)
+
 src: $(DEPSDIR)/.built
 	$(REBAR) $(SKIPDEPS) compile
 	$(EXPLICIT_ELIXIR_COMPILE)
@@ -311,7 +320,8 @@ BINARIES=$(DEPSDIR)/epam/priv/bin/epam $(DEPSDIR)/eimp/priv/bin/eimp $(DEPSDIR)/
 DEPS_FILES_FILTERED=$(filter-out $(BINARIES) $(DEPSDIR)/elixir/ebin/elixir.app,$(DEPS_FILES))
 DEPS_DIRS=$(sort $(DEPSDIR)/ $(foreach DEP,$(DEPS),$(DEPSDIR)/$(DEP)/) $(dir $(DEPS_FILES)))
 
-MAIN_FILES=$(filter-out %/configure.beam,$(call FILES_WILDCARD,$(EBINDIR)/*.beam $(EBINDIR)/*.app priv/msgs/*.msg priv/css/*.css priv/img/*.png priv/js/*.js priv/lib/* priv/mod_invites/* priv/mod_invites/static/* priv/mod_invites/static/logos/* include/*.hrl COPYING))
+MAIN_FILES=$(filter-out %/configure.beam,$(call FILES_WILDCARD,$(EBINDIR)/*.beam $(EBINDIR)/*.app priv/msgs/*.msg priv/css/*.css priv/img/*.png priv/js/*.js priv/lib/* priv/mod_invites/* priv/mod_invites/static/* priv/mod_invites/static/bootstrap4/css/bootstrap.min.css priv/mod_invites/static/bootstrap4/js/bootstrap.min.js priv/mod_invites/static/jquery/jquery.min.js \
+	priv/mod_invites/static/logos/* include/*.hrl COPYING))
 MAIN_DIRS=$(sort $(dir $(MAIN_FILES)) priv/bin priv/sql priv/lua priv/mod_invites)
 
 define DEP_VERSION_template
@@ -553,6 +563,7 @@ clean:
 	rm -rf test/*.beam
 	rm -f rebar.lock
 	rm -f ejabberdctl.example ejabberd.init ejabberd.service
+	rm -rf priv/mod_invites/static/{jquery,bootstrap4}
 	$(REBAR) clean $(CLEANARG)
 
 clean-rel:

package.json

@@ -0,0 +1,15 @@
+{
+  "name": "ejabberd",
+  "version": "1.0.0",
+  "dependencies": {
+    "bootstrap": "^5.3.8",
+    "jquery": "^4.0.0"
+  },
+  "scripts": {
+    "postinstall": "npm run -s clean && npm run -s mkdir-jquery && npm run -s cp-jquery && npm run -s cp-bootstrap",
+    "clean": "rm -rf priv/mod_invites/static/{jquery,bootstrap}",
+    "mkdir-jquery": "mkdir -p priv/mod_invites/static/jquery",
+    "cp-jquery": "cp node_modules/jquery/dist/jquery.min.js priv/mod_invites/static/jquery/jquery.min.js",
+    "cp-bootstrap": "cp -r node_modules/bootstrap/dist priv/mod_invites/static/bootstrap"
+  }
+}

priv/mod_invites/apps.html

@@ -1,26 +1,26 @@
-        <div class="container">
+        <div class="container mb-0">
             <div class="row">
                 {% for item in apps %}
-                <div class="card m-3 client-card {% for platform in item.platforms %}app-platform-{{ platform|lower }} {% endfor %} flex-wrap col-sm-12 col-md-8 col-lg-5">
+                <div class="card mx-0 mb-3 me-3 client-card {% for platform in item.platforms %}app-platform-{{ platform|lower }} {% endfor %}flex-wrap col-sm-12 col-md-8 col-lg-5">
                     <div class="row no-gutters h-100">
-                        <div class="col-md-4">
+                        <div class="col-md-4 pt-2 mt-1">
                             <img src="{{ static }}/{{ item.image }}" class="p-2 img-fluid" alt="{{ item.alttext }}">
                         </div>
                         <div class="col-md-8">
                             <div class="card-body d-flex flex-column h-100">
                                 <h3 class="card-title text-nowrap mb-1 h5">{{ item.name }}</h3>
                                 <div>
-                                    {% for platform in item.platforms %}<span class="badge badge-info client-platform-badge client-platform-badge-{{ platform|lower }} mr-1 mb-3">{{ platform }}</span>{% endfor %}
+                                    {% for platform in item.platforms %}<span class="badge text-bg-info client-platform-badge client-platform-badge-{{ platform|lower }} me-1 mb-3">{{ platform }}</span>{% endfor %}
                                 </div>
                                 <p class="card-text">{{ item.text }}</p>
-                                <a href="{{ item.proceed_url }}" class="btn btn-primary mt-md-auto">{% if item.select_text %}{{ item.select_text }}{% else %}{% trans "Select" %}{% endif %}</a>
+                                <a href="{{ item.proceed_url }}" class="btn btn-primary mt-md-auto" tabindex="{{ forloop.counter|add:2 }}">{% if item.select_text %}{{ item.select_text }}{% else %}{% trans "Select" %}{% endif %}</a>
                             </div>
                         </div>
                     </div>
                 </div>
                 {% endfor %}
             </div>
         </div>
-        <div id="show-all-clients-button-container" class="d-none alert alert-info">
-            {% trans "Showing apps for <span class='platform-name'>your current platform</span> only. You may also <a href='#' id='show-all-clients-button'>view all apps.</a>" %}
+        <div id="show-all-clients-button-container" class="d-none alert alert-info mb-0">
+            {% blocktrans with tabidx=apps|length|add:2 %}Showing apps for <span class='platform-name'>your current platform</span> only. You may also <a href='#' id='show-all-clients-button' tabindex="{{ tabidx }}">view all apps.</a>{% endblocktrans %}
         </div>

priv/mod_invites/apps.json

@@ -69,6 +69,27 @@
         "supports_preauth_uri": true,
         "text": "{% trans 'A modern open-source chat client for Mac. It is easy to use and has a clean user interface.' %}"
     },
+    {
+        "download": {
+            "buttons": [
+                {
+                    "image": "{{ static }}/logos/google_ps.png",
+                    "alttext": "{% trans 'Google Play Store Logo' %}",
+                    "url": "https://play.google.com/store/apps/details?id=org.yaxim.androidclient",
+                    "magic_link_format": "https://play.google.com/store/apps/details?id=org.yaxim.androidclient&referrer={{ uri }}"
+                }
+            ]
+        },
+        "image": "logos/yaxim.svg",
+        "link": "https://play.google.com/store/apps/details?id=org.yaxim.androidclient",
+        "magic_link_format": "https://play.google.com/store/apps/details?id=org.yaxim.androidclient&referrer={{ uri }}",
+        "name": "yaxim",
+        "platforms": [
+            "Android"
+        ],
+        "supports_preauth_uri": true,
+        "text": "{% trans 'A lean Jabber/XMPP client for Android. It aims at usability, low overhead and security, and works on low-end Android devices starting with Android 4.0.' %}"
+    },
     {
         "download": {
             "buttons": [

priv/mod_invites/base.html

@@ -3,10 +3,10 @@
 {% block rel_alternate %}<link rel="alternate" href="{{ uri }}">{% endblock %}
 
 {% block qr_button %}
-        <div id="qr-button-container" class="float-right w-25 border border-info p-3 d-none">
+        <div id="qr-button-container" class="float-end w-25 border border-info p-3 ms-3 d-none">
           {% trans "<strong>Tip:</strong> You can open this invite on your mobile device by scanning a barcode with your camera." %}
-          <button id="qr-modal-show" class="mt-2 d-block btn btn-info" title="{% trans "Send this invite to your device" %}"
-              data-toggle="modal" data-target="#qr-modal">
+          <button id="qr-modal-show" class="mt-2 mx-auto d-block btn btn-info" title="{% trans "Send this invite to your device" %}"
+              data-bs-toggle="modal" data-bs-target="#qr-modal" tabindex="1">
             {% trans "Scan with mobile device" %}
           </button>
         </div>
@@ -17,20 +17,18 @@
       <div class="modal-dialog" role="document">
         <div class="modal-content">
           <div class="modal-header">
-            <h2 class="modal-title h5">{% trans "Scan invite code" %}</h2>
-            <button type="button" class="close" data-dismiss="modal" aria-label="Close">
-              <span aria-hidden="true">&times;</span>
-            </button>
+            <h1 class="modal-title h5">{% trans "Scan invite code" %}</h1>
+            <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
           </div>
           <div class="modal-body">
             <p>{% trans "You can transfer this invite to your mobile device by scanning a code with your camera." %}</p>
             <div id="qr-info-url" class="tab-pane show active">
               <p>{% trans "Use a <em>QR code</em> scanner on your mobile device to scan the code below:" %}</p>
-              <div id="qr-invite-page" style="width: 256px;" class="bg-light mx-auto"></div>
+              <div id="qr-invite-page" class="bg-light mx-auto"></div>
             </div>
           </div>
           <div class="modal-footer">
-            <button type="button" class="btn btn-primary" data-dismiss="modal">{% trans "Close" %}</button>
+            <button type="button" class="btn btn-primary" data-bs-dismiss="modal" tabindex="2">{% trans "Close" %}</button>
           </div>
         </div>
       </div>
@@ -40,5 +38,4 @@ <h2 class="modal-title h5">{% trans "Scan invite code" %}</h2>
 {% block extra_scripts %}
     <script src="{{ static }}/qrcode.min.js" integrity="sha384-XfbBihCQqSDyejklP5yun2CbVxqR+2eNfx0Fhx5pQAfN5ypWGhSBjXaXr5g6X4DE"></script>
     <script src="{{ static }}/platform.min.js" integrity="sha384-nziKWRrD67nso9WErLVLhgT7AobHh6aYfNgqgINmJrtZ92V9aNTaOpvDFkcneToL"></script>
-    <script src="{{ static }}/invite.js" integrity="sha384-VDcwQaNoQOICI6fBdS75yBQDylgcTGJ2gDuq6uOcp92IwCpkIO8ik3Qllin/FKwX"></script>
 {% endblock %}

priv/mod_invites/base_min.html

@@ -3,44 +3,18 @@
   <head>
     <meta charset="utf-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>{% block title %}{% blocktrans %}Invite to {{ site_name }}{% endblocktrans %}{% endblock %}</title>
+    <title>{% block title %}{% trans "Invite" %} | {{ site_name }}{% endblock %}</title>
     {% block rel_alternate %}{% endblock %}
-    <link rel="stylesheet" href="/share/bootstrap4/css/bootstrap.min.css" integrity="MCw98/SFnGE8fJT3GXwEOngsV7Zt27NXFoaoApmYm81iuXoPkFOJwJ8ERdknLPMO">
-    <!-- <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png"> -->
-    <!-- <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png"> -->
-    <!-- <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png"> -->
-    <!-- <link rel="manifest" href="/site.webmanifest"> -->
-    <!-- <link rel="mask-icon" href="/safari-pinned-tab.svg" color="#5bbad5"> -->
-    <meta name="msapplication-TileColor" content="#fbd308">
-    <meta name="theme-color" content="#fbd308">
-    <style>
-        #other-software a {
-            text-decoration: underline;
-            color: #0072ed;
-        }
-        a#show-all-clients-button {
-            text-decoration: underline;
-        }
-        .btn-primary {
-            background-color: #0072ed;
-        }
-        .badge-success {
-            background-color: #0a8927;
-        }
-        .alert-info, .alert-info a, .btn-info {
-            background-color: #008297;
-            color: white;
-        }
-        .border-info {
-            border-color: #008297 !important;
-        }
-    </style>
+    <link rel="stylesheet" href="{{ static }}/bootstrap/css/bootstrap.min.css" integrity="sha384-sRIl4kxILFvY47J16cr9ZwB07vP4J8+LH7qKQnuqkuIAvNWLzeN8tE5YBujZqJLB">
+    <link rel="icon" type="image/png" sizes="32x32" href="{{ static }}/favicon.png">
+    <meta name="msapplication-TileColor" content="#4acac3">
+    <meta name="theme-color" content="#4acac3">
+    <link rel="stylesheet" href="{{ static }}/invite.css" integrity="sha384-k6usDEL8f5OYugdzmHwAlWjdQA/YkOZre60c604zXvE9fSJpptDg2jzE2PaQ5/c+">
   </head>
   <body>
-    <div id="background" class="fixed-top overflow-hidden"></div>
-    <div id="form" class="{% block form_class %}container col-md-10 col-md-offset-1 col-sm-8 col-sm-offset-2 col-lg-10 col-lg-offset-1 mt-2 mt-md-5{% endblock %}">
-      <div class="card rounded-lg shadow">
-        <h1 class="card-header rounded-lg rounded-lg">{%block h1 %}{% blocktrans %}Invite to {{ site_name }}{% endblocktrans %}{% endblock %}</h1>
+    <div id="form" class="{% block form_class %}container col-md-10 col-md-offset-1 col-sm-8 col-sm-offset-2 col-lg-10 col-lg-offset-1 my-3 mt-md-5{% endblock %}">
+      <div class="card rounded-2 shadow">
+        <h1 class="card-header">{%block h1 %}{% blocktrans %}Invite to {{ site_name }}{% endblocktrans %}{% endblock %}</h1>
         <div class="card-body">
           {% block qr_button %}{% endblock %}
           {% block content %}{% endblock %}
@@ -49,7 +23,8 @@ <h1 class="card-header rounded-lg rounded-lg">{%block h1 %}{% blocktrans %}Invit
     </div>
     {% block qr_code %}{% endblock %}
     {% block extra_scripts %}{% endblock %}
-    <script src="/share/jquery/jquery.min.js" integrity="sha384-1H217gwSVyLSIfaLxHbE7dRb3v4mYCKbpQvzx0cegeju1MVsGrX5xXxAvs/HgeFs"></script>
-    <script src="/share/bootstrap4/js/bootstrap.min.js" integrity="sha384-ChfqqxuZUCnJSK3+MXmPNIyE6ZbWh2IMqE241rYiqJxyMiZ6OW/JmZQ5stwEULTy"></script>
+    <script src="{{ static }}/jquery/jquery.min.js" integrity="sha384-fgGyf7Mo7DURSOMnOy7ed+dkq5Job205Gnzu6QIg0BOHKaqt4D76Dt8VlDCzcMHV"></script>
+    <script src="{{ static }}/bootstrap/js/bootstrap.min.js" integrity="sha384-G/EV+4j2dNv+tEPo3++6LCgdCROaejBqfUeNjuKAiuXbjrxilcCdDz6ZAVfHWe1Y"></script>
+    <script src="{{ static }}/invite.js" integrity="sha384-ov8LmXw6nEmT+QvXBRPMol0e90WFX9ZysvQudQ7H+nYDyolH4K/+GKJhq7qmTk4T"></script>
   </body>
 </html>