Files
computer-playbook/roles/web-app-suitecrm/files/Dockerfile
kevinveenbirkenbach d2abd332f0 fix(web-app-suitecrm): let the external-auth provisioning path create its user
SuiteCRM 8.10.2 tightened User::hasSaveAccess() from return true to is_admin($current_user) for a record without an id, and restrictAdminOnlyFields() now forces status Inactive on such a record. CreateUser::create() runs while the browser is still anonymous, because it is the LDAP and SAML auto-create path, so every FIRST login of a directory account ends in RuntimeException: Not authorized and HTTP 500 on POST /login. The pre-existing administrator is unaffected, which is why one persona passes and one fails in both auth modes. 451f63cbdd carried the role from 8.9.1 to 8.10.2; 8.9.1 exempted a new record from both guards.

The patch raises the admin context around that one save and restores it in a finally, rather than relaxing the guards, which stay closed for every request-driven save. create() has a single caller in its own file, createExternalAuthUser, which sets is_admin 0 and external_auth_only 1 before calling, so the raised context cannot mint an administrator. patch runs with -F0 so a hunk upstream has moved fails the build instead of landing somewhere else.

The patch path is derived once in vars/main.yml and reaches the Dockerfile as a build arg, following the role's existing SUITECRM_ENTRYPOINT_SCRIPT_* shape, so the file name is written once.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 495d23dbde)

# Conflicts:
#	roles/web-app-suitecrm/vars/main.yml
2026-10-16 13:29:07 +02:00

160 lines
4.6 KiB
Docker

ARG SUITECRM_BASE_IMAGE
ARG SUITECRM_BASE_VERSION
FROM ${SUITECRM_BASE_IMAGE}:${SUITECRM_BASE_VERSION} AS base
ARG SUITECRM_APP_DIR
ARG SUITECRM_PHP_MEMORY_LIMIT
ARG SUITECRM_PHPREDIS_VERSION
RUN rm -rf /var/lib/apt/lists/* \
&& apt-get -o Acquire::Retries=3 update && apt-get -o Acquire::Retries=3 install -y \
git \
wget \
curl \
unzip \
libpng-dev \
libzip-dev \
libicu-dev \
libonig-dev \
libxml2-dev \
libldap2-dev \
patch \
&& docker-php-ext-configure ldap --with-libdir=lib/x86_64-linux-gnu \
&& docker-php-ext-install \
pdo \
pdo_mysql \
mysqli \
gd \
zip \
intl \
mbstring \
soap \
opcache \
ldap \
&& rm -rf /var/lib/apt/lists/*
RUN : "${SUITECRM_PHPREDIS_VERSION:?}" \
&& pecl install "redis-${SUITECRM_PHPREDIS_VERSION}" \
&& docker-php-ext-enable redis
RUN : "${SUITECRM_PHP_MEMORY_LIMIT:?}" && { \
echo 'file_uploads = On'; \
echo 'upload_max_filesize = 32M'; \
echo 'post_max_size = 32M'; \
echo "memory_limit = ${SUITECRM_PHP_MEMORY_LIMIT}"; \
} > /usr/local/etc/php/conf.d/suitecrm-upload.ini
RUN a2enmod rewrite headers
RUN sed -ri 's!'"${SUITECRM_APP_DIR}"'!'"${SUITECRM_APP_DIR}"'/public!g' \
/etc/apache2/sites-available/000-default.conf \
/etc/apache2/apache2.conf
FROM base AS builder
ARG SUITECRM_APP_VERSION
ARG SUITECRM_APP_DIR
ARG SUITECRM_LDAP_EXTENSION_DIR
ARG SUITECRM_EXTERNAL_AUTH_PATCH_HOST_REL
ARG SUITECRM_EXTERNAL_AUTH_PATCH_DOCKER
WORKDIR ${SUITECRM_APP_DIR}
COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
RUN set -eux; \
SUITECRM_TAG="v${SUITECRM_APP_VERSION}"; \
wget -qO /tmp/suitecrm.tar.gz \
"https://github.com/SuiteCRM/SuiteCRM-Core/archive/refs/tags/${SUITECRM_TAG}.tar.gz"; \
tar --strip-components=1 -xzf /tmp/suitecrm.tar.gz -C "${SUITECRM_APP_DIR}"; \
rm /tmp/suitecrm.tar.gz; \
chmod +x bin/console
COPY ${SUITECRM_EXTERNAL_AUTH_PATCH_HOST_REL} ${SUITECRM_EXTERNAL_AUTH_PATCH_DOCKER}
RUN set -eux; \
patch -p1 -F0 -i ${SUITECRM_EXTERNAL_AUTH_PATCH_DOCKER}; \
rm ${SUITECRM_EXTERNAL_AUTH_PATCH_DOCKER}
RUN set -eux; \
composer install \
--prefer-dist \
--no-interaction \
--optimize-autoloader \
--no-scripts
WORKDIR ${SUITECRM_APP_DIR}/public/legacy
RUN set -eux; \
if [ -f composer.json ]; then \
composer install --no-dev --prefer-dist --no-interaction --optimize-autoloader --no-scripts; \
fi
WORKDIR ${SUITECRM_APP_DIR}
RUN rm -rf /var/lib/apt/lists/* \
&& apt-get -o Acquire::Retries=3 update && apt-get -o Acquire::Retries=3 install -y nodejs npm \
&& corepack enable && corepack prepare yarn@4.5.1 --activate \
&& rm -rf /var/lib/apt/lists/*
RUN yarn install --immutable \
&& yarn merge-angular-json \
&& yarn build \
&& rm -rf .angular/cache .yarn/cache .yarn/unplugged .yarn/install-state.gz \
&& rm -rf node_modules
RUN set -eux; \
php ./vendor/bin/pscss -s compressed \
public/legacy/themes/suite8/css/Dawn/style.scss \
> public/legacy/themes/suite8/css/Dawn/style.css
RUN set -eux; \
composer install \
--no-dev \
--prefer-dist \
--no-interaction \
--optimize-autoloader \
--no-scripts; \
COMPOSER_ALLOW_SUPERUSER=1 composer dump-autoload --no-dev --optimize --no-interaction
RUN set -eux; \
mkdir -p "${SUITECRM_LDAP_EXTENSION_DIR}"; \
for d in cache public/upload public/legacy/upload public/legacy/cache tmp; do \
mkdir -p "${SUITECRM_APP_DIR}/${d}"; \
chmod -R 775 "${SUITECRM_APP_DIR}/${d}"; \
done
FROM base
ARG SUITECRM_ENTRYPOINT_SCRIPT_HOST_REL
ARG SUITECRM_ENTRYPOINT_SCRIPT_DOCKER
ARG SUITECRM_APP_DIR
ARG SUITECRM_APP_VERSION
ARG SUITECRM_SEED_DIR
ARG SUITECRM_WEB_USER
ARG SUITECRM_WEB_GROUP
ENV SUITECRM_APP_DIR=${SUITECRM_APP_DIR} \
SUITECRM_APP_VERSION=${SUITECRM_APP_VERSION} \
SUITECRM_SEED_DIR=${SUITECRM_SEED_DIR} \
SUITECRM_WEB_USER=${SUITECRM_WEB_USER} \
SUITECRM_WEB_GROUP=${SUITECRM_WEB_GROUP}
COPY --from=builder --chown=${SUITECRM_WEB_USER}:${SUITECRM_WEB_GROUP} ${SUITECRM_APP_DIR} ${SUITECRM_SEED_DIR}
RUN test -f "${SUITECRM_SEED_DIR}/vendor/autoload_runtime.php"
RUN set -eux; \
mkdir -p "${SUITECRM_APP_DIR}"; \
chown "${SUITECRM_WEB_USER}:${SUITECRM_WEB_GROUP}" "${SUITECRM_APP_DIR}"
WORKDIR ${SUITECRM_APP_DIR}
COPY ${SUITECRM_ENTRYPOINT_SCRIPT_HOST_REL} ${SUITECRM_ENTRYPOINT_SCRIPT_DOCKER}
RUN chmod +x ${SUITECRM_ENTRYPOINT_SCRIPT_DOCKER} \
&& ln -sf "${SUITECRM_ENTRYPOINT_SCRIPT_DOCKER}" /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]
CMD ["apache2-foreground"]