mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
SuiteCRM 8.10.2 tightened User::hasSaveAccess() from return true to is_admin($current_user) for a record without an id, and restrictAdminOnlyFields() now forces status Inactive on such a record. CreateUser::create() runs while the browser is still anonymous, because it is the LDAP and SAML auto-create path, so every FIRST login of a directory account ends in RuntimeException: Not authorized and HTTP 500 on POST /login. The pre-existing administrator is unaffected, which is why one persona passes and one fails in both auth modes.451f63cbddcarried the role from 8.9.1 to 8.10.2; 8.9.1 exempted a new record from both guards. The patch raises the admin context around that one save and restores it in a finally, rather than relaxing the guards, which stay closed for every request-driven save. create() has a single caller in its own file, createExternalAuthUser, which sets is_admin 0 and external_auth_only 1 before calling, so the raised context cannot mint an administrator. patch runs with -F0 so a hunk upstream has moved fails the build instead of landing somewhere else. The patch path is derived once in vars/main.yml and reaches the Dockerfile as a build arg, following the role's existing SUITECRM_ENTRYPOINT_SCRIPT_* shape, so the file name is written once. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> (cherry picked from commit495d23dbde) # Conflicts: # roles/web-app-suitecrm/vars/main.yml
160 lines
4.6 KiB
Docker
160 lines
4.6 KiB
Docker
ARG SUITECRM_BASE_IMAGE
|
|
ARG SUITECRM_BASE_VERSION
|
|
|
|
FROM ${SUITECRM_BASE_IMAGE}:${SUITECRM_BASE_VERSION} AS base
|
|
|
|
ARG SUITECRM_APP_DIR
|
|
ARG SUITECRM_PHP_MEMORY_LIMIT
|
|
ARG SUITECRM_PHPREDIS_VERSION
|
|
|
|
RUN rm -rf /var/lib/apt/lists/* \
|
|
&& apt-get -o Acquire::Retries=3 update && apt-get -o Acquire::Retries=3 install -y \
|
|
git \
|
|
wget \
|
|
curl \
|
|
unzip \
|
|
libpng-dev \
|
|
libzip-dev \
|
|
libicu-dev \
|
|
libonig-dev \
|
|
libxml2-dev \
|
|
libldap2-dev \
|
|
patch \
|
|
&& docker-php-ext-configure ldap --with-libdir=lib/x86_64-linux-gnu \
|
|
&& docker-php-ext-install \
|
|
pdo \
|
|
pdo_mysql \
|
|
mysqli \
|
|
gd \
|
|
zip \
|
|
intl \
|
|
mbstring \
|
|
soap \
|
|
opcache \
|
|
ldap \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN : "${SUITECRM_PHPREDIS_VERSION:?}" \
|
|
&& pecl install "redis-${SUITECRM_PHPREDIS_VERSION}" \
|
|
&& docker-php-ext-enable redis
|
|
|
|
RUN : "${SUITECRM_PHP_MEMORY_LIMIT:?}" && { \
|
|
echo 'file_uploads = On'; \
|
|
echo 'upload_max_filesize = 32M'; \
|
|
echo 'post_max_size = 32M'; \
|
|
echo "memory_limit = ${SUITECRM_PHP_MEMORY_LIMIT}"; \
|
|
} > /usr/local/etc/php/conf.d/suitecrm-upload.ini
|
|
|
|
RUN a2enmod rewrite headers
|
|
|
|
RUN sed -ri 's!'"${SUITECRM_APP_DIR}"'!'"${SUITECRM_APP_DIR}"'/public!g' \
|
|
/etc/apache2/sites-available/000-default.conf \
|
|
/etc/apache2/apache2.conf
|
|
|
|
|
|
FROM base AS builder
|
|
|
|
ARG SUITECRM_APP_VERSION
|
|
ARG SUITECRM_APP_DIR
|
|
ARG SUITECRM_LDAP_EXTENSION_DIR
|
|
ARG SUITECRM_EXTERNAL_AUTH_PATCH_HOST_REL
|
|
ARG SUITECRM_EXTERNAL_AUTH_PATCH_DOCKER
|
|
|
|
WORKDIR ${SUITECRM_APP_DIR}
|
|
|
|
COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
|
|
|
|
RUN set -eux; \
|
|
SUITECRM_TAG="v${SUITECRM_APP_VERSION}"; \
|
|
wget -qO /tmp/suitecrm.tar.gz \
|
|
"https://github.com/SuiteCRM/SuiteCRM-Core/archive/refs/tags/${SUITECRM_TAG}.tar.gz"; \
|
|
tar --strip-components=1 -xzf /tmp/suitecrm.tar.gz -C "${SUITECRM_APP_DIR}"; \
|
|
rm /tmp/suitecrm.tar.gz; \
|
|
chmod +x bin/console
|
|
|
|
COPY ${SUITECRM_EXTERNAL_AUTH_PATCH_HOST_REL} ${SUITECRM_EXTERNAL_AUTH_PATCH_DOCKER}
|
|
RUN set -eux; \
|
|
patch -p1 -F0 -i ${SUITECRM_EXTERNAL_AUTH_PATCH_DOCKER}; \
|
|
rm ${SUITECRM_EXTERNAL_AUTH_PATCH_DOCKER}
|
|
|
|
RUN set -eux; \
|
|
composer install \
|
|
--prefer-dist \
|
|
--no-interaction \
|
|
--optimize-autoloader \
|
|
--no-scripts
|
|
|
|
WORKDIR ${SUITECRM_APP_DIR}/public/legacy
|
|
|
|
RUN set -eux; \
|
|
if [ -f composer.json ]; then \
|
|
composer install --no-dev --prefer-dist --no-interaction --optimize-autoloader --no-scripts; \
|
|
fi
|
|
|
|
WORKDIR ${SUITECRM_APP_DIR}
|
|
|
|
RUN rm -rf /var/lib/apt/lists/* \
|
|
&& apt-get -o Acquire::Retries=3 update && apt-get -o Acquire::Retries=3 install -y nodejs npm \
|
|
&& corepack enable && corepack prepare yarn@4.5.1 --activate \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN yarn install --immutable \
|
|
&& yarn merge-angular-json \
|
|
&& yarn build \
|
|
&& rm -rf .angular/cache .yarn/cache .yarn/unplugged .yarn/install-state.gz \
|
|
&& rm -rf node_modules
|
|
|
|
RUN set -eux; \
|
|
php ./vendor/bin/pscss -s compressed \
|
|
public/legacy/themes/suite8/css/Dawn/style.scss \
|
|
> public/legacy/themes/suite8/css/Dawn/style.css
|
|
|
|
RUN set -eux; \
|
|
composer install \
|
|
--no-dev \
|
|
--prefer-dist \
|
|
--no-interaction \
|
|
--optimize-autoloader \
|
|
--no-scripts; \
|
|
COMPOSER_ALLOW_SUPERUSER=1 composer dump-autoload --no-dev --optimize --no-interaction
|
|
|
|
RUN set -eux; \
|
|
mkdir -p "${SUITECRM_LDAP_EXTENSION_DIR}"; \
|
|
for d in cache public/upload public/legacy/upload public/legacy/cache tmp; do \
|
|
mkdir -p "${SUITECRM_APP_DIR}/${d}"; \
|
|
chmod -R 775 "${SUITECRM_APP_DIR}/${d}"; \
|
|
done
|
|
|
|
|
|
FROM base
|
|
|
|
ARG SUITECRM_ENTRYPOINT_SCRIPT_HOST_REL
|
|
ARG SUITECRM_ENTRYPOINT_SCRIPT_DOCKER
|
|
ARG SUITECRM_APP_DIR
|
|
ARG SUITECRM_APP_VERSION
|
|
ARG SUITECRM_SEED_DIR
|
|
ARG SUITECRM_WEB_USER
|
|
ARG SUITECRM_WEB_GROUP
|
|
ENV SUITECRM_APP_DIR=${SUITECRM_APP_DIR} \
|
|
SUITECRM_APP_VERSION=${SUITECRM_APP_VERSION} \
|
|
SUITECRM_SEED_DIR=${SUITECRM_SEED_DIR} \
|
|
SUITECRM_WEB_USER=${SUITECRM_WEB_USER} \
|
|
SUITECRM_WEB_GROUP=${SUITECRM_WEB_GROUP}
|
|
|
|
COPY --from=builder --chown=${SUITECRM_WEB_USER}:${SUITECRM_WEB_GROUP} ${SUITECRM_APP_DIR} ${SUITECRM_SEED_DIR}
|
|
|
|
RUN test -f "${SUITECRM_SEED_DIR}/vendor/autoload_runtime.php"
|
|
|
|
RUN set -eux; \
|
|
mkdir -p "${SUITECRM_APP_DIR}"; \
|
|
chown "${SUITECRM_WEB_USER}:${SUITECRM_WEB_GROUP}" "${SUITECRM_APP_DIR}"
|
|
|
|
WORKDIR ${SUITECRM_APP_DIR}
|
|
|
|
COPY ${SUITECRM_ENTRYPOINT_SCRIPT_HOST_REL} ${SUITECRM_ENTRYPOINT_SCRIPT_DOCKER}
|
|
RUN chmod +x ${SUITECRM_ENTRYPOINT_SCRIPT_DOCKER} \
|
|
&& ln -sf "${SUITECRM_ENTRYPOINT_SCRIPT_DOCKER}" /entrypoint.sh
|
|
|
|
ENTRYPOINT ["/entrypoint.sh"]
|
|
CMD ["apache2-foreground"]
|