diff --git a/.travis.yml b/.travis.yml index f90895d369e..1bddb6a993f 100644 --- a/.travis.yml +++ b/.travis.yml @@ -4,7 +4,7 @@ before_install: - sudo apt-get -y install libtool automake autoconf autoconf-archive - sudo apt-get -y install texlive-latex-base texlive-latex-recommended - sudo apt-get -y install texlive-latex-extra texlive-fonts-recommended texinfo - - sudo apt-get -y install python-pygments python-docutils python-sphinx + - sudo apt-get -y install python-pygments python-docutils python-sphinx before_script: ./bootstrap && ./configure script: - make distcheck @@ -13,6 +13,7 @@ script: - grunt test language: erlang otp_release: - - R16B + - 17.0 + - R16B03-1 - R15B03 - R14B04 diff --git a/INSTALL.Unix b/INSTALL.Unix index a07055884db..f66f98cf0bd 100644 --- a/INSTALL.Unix +++ b/INSTALL.Unix @@ -39,10 +39,10 @@ Dependencies You should have the following installed: - * Erlang OTP (>=R13B04, =R14B01, =&- + exec 2>&- while true; do export HEART_COMMAND export HEART_BEAT_TIMEOUT diff --git a/configure.ac b/configure.ac index 57a4268a405..656758564ae 100644 --- a/configure.ac +++ b/configure.ac @@ -33,6 +33,10 @@ AC_DISABLE_STATIC AC_PROG_CC LT_INIT([win32-dll]) LT_INIT +AS_IF([test x"${enable_shared}" = "xno"], [ + AC_MSG_ERROR([System as configured cannot build shared libraries.]) +]) + AC_PROG_LN_S PKG_PROG_PKG_CONFIG @@ -411,23 +415,25 @@ esac { $as_echo "$as_me:${as_lineno-$LINENO}: checking Erlang version compatibility" >&5 $as_echo_n "checking Erlang version compatibility... " >&6; } -erlang_version_error="The installed Erlang version must be >= R14B (erts-5.8.1) and xR13B03]) -AM_CONDITIONAL([USE_EJSON_COMPARE_NIF], [test x$otp_release \> xR14B03]) +AM_CONDITIONAL([USE_OTP_NIFS], + [can_use_nifs=$(echo $otp_release | grep -E "^(R14B|R15|R16|17)")]) +AM_CONDITIONAL([USE_EJSON_COMPARE_NIF], + [can_use_ejson=$(echo $otp_release | grep -E "^(R14B03|R15|R16|17)")]) has_crypto=`\ ${ERL} -eval "\ diff --git a/etc/couchdb/default.ini.tpl.in b/etc/couchdb/default.ini.tpl.in index 934c6cd440c..f3b36eb09ee 100644 --- a/etc/couchdb/default.ini.tpl.in +++ b/etc/couchdb/default.ini.tpl.in @@ -68,7 +68,7 @@ include_sasl = true authentication_db = _users authentication_redirect = /_utils/session.html require_valid_user = false -timeout = 600 ; number of seconds before automatic logout +timeout = 600 ; The number of seconds before automatic logout. The minimum value is 60, and any value less 60 will be ignored. auth_cache_size = 50 ; size is number of cache entries allow_persistent_cookies = false ; set to true to allow persistent cookies iterations = 10 ; iterations for password hashing diff --git a/etc/couchdb/local.ini b/etc/couchdb/local.ini index 8aae3315f99..b102881846c 100644 --- a/etc/couchdb/local.ini +++ b/etc/couchdb/local.ini @@ -75,6 +75,15 @@ verify_ssl_certificates = false ;verify_fun = {Module, VerifyFun} ; maximum peer certificate depth ssl_certificate_max_depth = 1 +; +; Reject renegotiations that do not live up to RFC 5746. +;secure_renegotiate = true +; The cipher suites that should be supported. +; Can be specified in erlang format "{ecdhe_ecdsa,aes_128_cbc,sha256}" +; or in OpenSSL format "ECDHE-ECDSA-AES128-SHA256". +;ciphers = ["ECDHE-ECDSA-AES128-SHA256", "ECDHE-ECDSA-AES128-SHA"] +; The SSL/TLS versions to support +;tls_versions = [sslv3, tlsv1, 'tlsv1.1', 'tlsv1.2'] ; To enable Virtual Hosts in CouchDB, add a vhost = path directive. All requests to ; the Virual Host will be redirected to the path. In the example below all requests diff --git a/share/Makefile.am b/share/Makefile.am index 84b91cb9a58..1598dfff6af 100644 --- a/share/Makefile.am +++ b/share/Makefile.am @@ -59,6 +59,7 @@ nobase_dist_localdata_DATA = \ www/dialog/_admin_party.html \ www/dialog/_change_password.html \ www/dialog/_compact_cleanup.html \ + www/dialog/_copy_document.html \ www/dialog/_create_admin.html \ www/dialog/_login.html \ www/dialog/_signup.html \ @@ -101,6 +102,7 @@ nobase_dist_localdata_DATA = \ www/image/bg.png \ www/image/cancel.gif \ www/image/compact.png \ + www/image/copy.png \ www/image/delete-mini.png \ www/image/delete.png \ www/image/grippie.gif \ @@ -142,7 +144,7 @@ nobase_dist_localdata_DATA = \ www/script/jquery.editinline.js \ www/script/jquery.form.js \ www/script/jquery.js \ - www/script/jquery-ui-1.8.11.custom.min.js \ + www/script/jquery-ui-1.9.2.custom.min.js \ www/script/jquery.resizer.js \ www/script/jquery.suggest.js \ www/script/json2.js \ diff --git a/share/doc/build/Makefile.am b/share/doc/build/Makefile.am index f332e5c5510..7b95d0d4163 100644 --- a/share/doc/build/Makefile.am +++ b/share/doc/build/Makefile.am @@ -390,6 +390,7 @@ src_files = \ ../src/cve/2012-5641.rst \ ../src/cve/2012-5649.rst \ ../src/cve/2012-5650.rst \ + ../src/cve/2014-2668.rst \ ../src/cve/index.rst \ ../src/fauxton/addons.rst \ ../src/fauxton/index.rst \ @@ -449,6 +450,7 @@ src_files_html = \ ../templates/layout.html \ ../templates/help.html \ ../templates/searchbox.html \ + ../templates/tracking.html \ ../templates/utilities.html sphinx_extensions = \ diff --git a/share/doc/src/api/ddoc/views.rst b/share/doc/src/api/ddoc/views.rst index 3d14396e9aa..4d0c8d8a79f 100644 --- a/share/doc/src/api/ddoc/views.rst +++ b/share/doc/src/api/ddoc/views.rst @@ -32,9 +32,9 @@ Ignored if `include_docs` isn't ``true``. Default is ``false`` :query boolean descending: Return the documents in descending by key order. Default is ``false`` - :query string endkey: Stop returning records when the specified key is + :query json endkey: Stop returning records when the specified key is reached. *Optional* - :query string end_key: Alias for `endkey` param + :query json end_key: Alias for `endkey` param :query string endkey_docid: Stop returning records when the specified document ID is reached. *Optional* :query string end_key_doc_id: Alias for `endkey_docid` param @@ -52,7 +52,7 @@ compressed. Ignored if `include_docs` isn't ``true``. Default is ``false``. :query boolean inclusive_end: Specifies whether the specified end key should be included in the result. Default is ``true`` - :query string key: Return only documents that match the specified key. + :query json key: Return only documents that match the specified key. *Optional* :query number limit: Limit the number of the returned documents to the specified number. *Optional* @@ -61,9 +61,9 @@ the results. Default is ``0`` :query string stale: Allow the results from a stale view to be used. Supported values: ``ok`` and ``update_after``. *Optional* - :query string startkey: Return records starting with the specified key. + :query json startkey: Return records starting with the specified key. *Optional* - :query string start_key: Alias for `startkey` param + :query json start_key: Alias for `startkey` param :query string startkey_docid: Return records starting with the specified document ID. *Optional* :query string start_key_doc_id: Alias for `startkey_docid` param diff --git a/share/doc/src/api/document/common.rst b/share/doc/src/api/document/common.rst index bdd67027d83..1355a314933 100644 --- a/share/doc/src/api/document/common.rst +++ b/share/doc/src/api/document/common.rst @@ -247,14 +247,14 @@ (latest) revision, either by using the ``rev`` parameter or by using the :header:`If-Match` header to specify the revision. + .. note:: + CouchDB doesn't completely delete the specified document. Instead, it leaves + a tombstone with very basic information about the document. The tombstone + is required so that the delete action can be replicated across databases. + .. seealso:: :ref:`Retrieving Deleted Documents ` - .. note:: - CouchDB doesn't actually delete documents. The reason is the need to track - them correctly during the replication process between databases to prevent - accidental document recovery for any previous state. - :param db: Database name :param docid: Document ID :
` +- :ref:`1.6.0 ` + +All listed releases have included a specific fix to + +Work-Around +=========== + +Disable the :ref:`api/server/uuids` handler completely, by adapting +`local.ini` and restarting CouchDB:: + + [httpd_global_handlers] + _uuids = + diff --git a/share/doc/src/install/unix.rst b/share/doc/src/install/unix.rst index 05e0459936e..76fe9225721 100644 --- a/share/doc/src/install/unix.rst +++ b/share/doc/src/install/unix.rst @@ -52,10 +52,10 @@ Dependencies You should have the following installed: -* `Erlang OTP (>=R13B04, `_ +* `Erlang OTP (>=R14B01, =`_ * `ICU `_ * `OpenSSL `_ -* `Mozilla SpiderMonkey (1.7) `_ +* `Mozilla SpiderMonkey (1.8.5) `_ * `GNU Make `_ * `GNU Compiler Collection `_ * `libcurl `_ @@ -102,19 +102,20 @@ RedHat-based (Fedora, Centos, RHEL) Systems You can install the dependencies by running:: - sudo yum groupinstall "Development Tools" sudo yum install autoconf sudo yum install autoconf-archive sudo yum install automake - sudo yum install libtool - sudo yum install perl-Test-Harness - sudo yum install erlang-etap + sudo yum install curl-devel + sudo yum install erlang-asn1 sudo yum install erlang-erts - sudo yum install erlang-os_mon sudo yum install erlang-eunit - sudo yum install libicu-devel + sudo yum install erlang-os_mon + sudo yum install erlang-xmerl + sudo yum install help2man sudo yum install js-devel - sudo yum install curl-devel + sudo yum install libicu-devel + sudo yum install libtool + sudo yum install perl-Test-Harness While CouchDB builds against the default js-devel-1.7.0 included in some distributions, it's recommended to use a more recent js-devel-1.8.5. diff --git a/share/doc/src/whatsnew/1.3.rst b/share/doc/src/whatsnew/1.3.rst index 7e697855cfa..3f19f56bc8d 100644 --- a/share/doc/src/whatsnew/1.3.rst +++ b/share/doc/src/whatsnew/1.3.rst @@ -21,6 +21,10 @@ :depth: 1 :local: +.. warning:: + + :ref:`release/1.3.x` is affected by the issue described in :ref:`cve/2014-2668`. + Upgrading to a more recent release is strongly recommended. .. _release/1.3.x/upgrade: diff --git a/share/doc/src/whatsnew/1.4.rst b/share/doc/src/whatsnew/1.4.rst index cf10befe696..65925e176a5 100644 --- a/share/doc/src/whatsnew/1.4.rst +++ b/share/doc/src/whatsnew/1.4.rst @@ -21,6 +21,10 @@ :depth: 1 :local: +.. warning:: + + :ref:`release/1.4.x` is affected by the issue described in :ref:`cve/2014-2668`. + Upgrading to a more recent release is strongly recommended. .. _release/1.4.x/upgrade: diff --git a/share/doc/src/whatsnew/1.5.rst b/share/doc/src/whatsnew/1.5.rst index 7f2d7509c37..1b7539a253f 100644 --- a/share/doc/src/whatsnew/1.5.rst +++ b/share/doc/src/whatsnew/1.5.rst @@ -21,6 +21,11 @@ :depth: 1 :local: +.. warning:: + + :ref:`release/1.5.1` contains important security fixes. Previous `1.5.x` + releases are not recommended for regular usage. + .. _release/1.5.1: Version 1.5.1 @@ -28,7 +33,7 @@ Version 1.5.1 * Add the ``max_count`` option (:ref:`config/uuids`) to allow rate-limiting the amount of UUIDs that can be requested from the :ref:`api/server/uuids` - handler in a single request. + handler in a single request (:ref:`CVE 2014-2668 `). .. _release/1.5.0: diff --git a/share/doc/src/whatsnew/1.6.rst b/share/doc/src/whatsnew/1.6.rst index 7d93ff64d9e..69002155c77 100644 --- a/share/doc/src/whatsnew/1.6.rst +++ b/share/doc/src/whatsnew/1.6.rst @@ -21,34 +21,57 @@ :depth: 1 :local: +.. warning:: + + :ref:`release/1.6.1` contains important patches to hash of passwords on + restart. The previous :ref:`release/1.6.0` release is not recommended for + usage as certain edge cases with admin passwords may prevent CouchDB from + starting. + .. _release/1.6.x/upgrade: -Upgrade Notes -============= +Deprecations +============ The :ref:`Proxy Authentication ` handler was renamed to -``proxy_authentication_handler`` to follow the ``*_authentication_handler`` form +``proxy_authentication_handler`` to follow the ``*_authentication_handler`` from of all other handlers. The old ``proxy_authentification_handler`` name is marked -as deprecated and will be removed in future releases. It's strongly recommended -to update :config:option:`httpd/authentication_handlers` option with new value -in case if you had used such handler. +as deprecated and will be removed in future releases. It's highly recommended +to update :config:option:`httpd/authentication_handlers` option with the new +value if you have used such a handler. + +.. _release/1.6.1: + +Version 1.6.1 +============= +A bugfix release to handle various edge cases related to admin password hashing. + +* :issue:`2298`: Hash plaintext admin passwords stored in ``local.ini`` on startup + :commit:`ed825d3`. +* :issue:`2299`: Filter out local admin users before updating password hash in + ``_users`` db :commit:`5e46f3b`. .. _release/1.6.0: Version 1.6.0 ============= -.. warning:: - - This version is not released yet. - +* :issue:`2200`: support Erlang/OTP 17.0 :commit:`35e16032` * Fauxton: many improvements in our experimental new user interface, including switching the code editor from CodeMirror to Ace as well as better support for various browsers. +* Add the ``max_count`` option (:ref:`config/uuids`) to allow rate-limiting + the amount of UUIDs that can be requested from the :ref:`api/server/uuids` + handler in a single request (:ref:`CVE 2014-2668 `). +* :issue:`1986`: increase socket buffer size to improve replication speed + for large documents and attachments, and fix tests on BSD-like systems. + :commit:`9a0e561b` +* :issue:`1953`: improve performance of multipart/related requests. + :commit:`ce3e89dc` +* :issue:`2221`: verify that authentication-related configuration settings + are well-formed. :commit:`dbe769c6` * :issue:`1922`: fix CORS exposed headers. :commit:`4f619833` -* Rename ``proxy_authentification_handler`` to ``proxy_authentication_handler``. - :commit:`c66ac4a8` * :issue:`1795`: ensure the startup script clears the pid file on termination. :commit:`818ef4f9` * :issue:`1962`: replication can now be performed without having write access @@ -61,7 +84,22 @@ Version 1.6.0 * :issue:`1923`: add support for `attachments` and `att_encoding_info` options (formerly only available on the documents API) to the view API. :commit:`ca41964b` +* :issue:`1780`: upgrade password hashes from SHA-1 to PBKDF2 scheme on + successful authentication. :commit:`34888938` +* :issue:`2059`: allow run-time configuration of maximum URL length. + :commit:`f7ca266b` +* :issue:`2054`: accept gzipped JSON request bodies. :commit:`4d893387` +* Rename ``proxy_authentification_handler`` to ``proxy_authentication_handler``. + :commit:`c66ac4a8` * :issue:`1647`: for failed replications originating from a document in the `_replicator` database, store the failure reason in the document. :commit:`08cac68b` -* A number of improvements for the documentation. +* :issue:`2053`: send better error messages when both `key` and `keys` + parameters are specified in view requests. :commit:`2bc07840` +* :issue:`2040`: send better error messages when incorrect checksums + are encountered during compaction. :commit:`e7fdc16a` +* :issue:`2028`: allow intermedia certificates when using SSL/TLS. + :commit:`2d080449` +* :issue:`2031`: fix rewriting of paths with query string parameters. + :commit:`37c84596` +* Numerous improvements to the documentation. diff --git a/share/www/dialog/_copy_document.html b/share/www/dialog/_copy_document.html new file mode 100644 index 00000000000..fe49e819966 --- /dev/null +++ b/share/www/dialog/_copy_document.html @@ -0,0 +1,29 @@ + +
+

Copy Document

+
+

+ Please enter a unique ID of the document: +

+ + +
+
+
+ + +
+
diff --git a/share/www/document.html b/share/www/document.html index e041cd9f0b8..1509475b72e 100644 --- a/share/www/document.html +++ b/share/www/document.html @@ -55,6 +55,7 @@ $("#toolbar button.save").click(page.saveDocument); $("#toolbar button.add").click(page.addField); $("#toolbar button.load").click(page.uploadAttachment); + $("#toolbar button.copy").click(page.copyDocument); if (page.isNew) { $("#toolbar button.delete").hide(); } else { @@ -76,6 +77,7 @@

    • +
    • diff --git a/share/www/image/copy.png b/share/www/image/copy.png new file mode 100644 index 00000000000..07b4f79159a Binary files /dev/null and b/share/www/image/copy.png differ diff --git a/share/www/replicator.html b/share/www/replicator.html index eb6ecc07661..79d136acfb6 100644 --- a/share/www/replicator.html +++ b/share/www/replicator.html @@ -25,7 +25,7 @@ - +