Version in base suite: 4.4.15+dfsg-0+deb13u1 Version in overlay suite: 4.4.20+dfsg-0+deb13u1 Base version: spip_4.4.20+dfsg-0+deb13u1 Target version: spip_4.4.21+dfsg-0+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/s/spip/spip_4.4.20+dfsg-0+deb13u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/s/spip/spip_4.4.21+dfsg-0+deb13u1.dsc CHANGELOG.md | 4 composer.lock | 12 - debian/changelog | 8 + debian/patches/0001-Fix-created-directories-and-files-default-rights.patch | 2 debian/patches/0003-Fix-displayed-version-in-the-private-interface.patch | 2 ecrire/CHANGELOG.md | 14 + ecrire/action/inscrire_auteur.php | 4 ecrire/inc/filtres.php | 27 --- ecrire/inc/filtres_mini.php | 27 +++ ecrire/inc/headers.php | 3 ecrire/inc_version.php | 4 ecrire/paquet.xml | 2 ecrire/public/composer.php | 2 ecrire/public/fonctions.php | 2 ecrire/req/sqlite_fonctions.php | 75 ++++++---- plugins-dist.json | 2 plugins-dist/filtres_images/CHANGELOG.md | 6 plugins-dist/filtres_images/filtres/images_transforme.php | 3 plugins-dist/filtres_images/paquet.xml | 2 vendor/composer/installed.json | 14 - vendor/composer/installed.php | 18 +- 21 files changed, 148 insertions(+), 85 deletions(-) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpsuh2qvgl/spip_4.4.20+dfsg-0+deb13u1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpsuh2qvgl/spip_4.4.21+dfsg-0+deb13u1.dsc: no acceptable signature found diff -Nru spip-4.4.20+dfsg/CHANGELOG.md spip-4.4.21+dfsg/CHANGELOG.md --- spip-4.4.20+dfsg/CHANGELOG.md 2026-08-17 10:07:16.000000000 +0000 +++ spip-4.4.21+dfsg/CHANGELOG.md 2026-08-20 11:46:58.000000000 +0000 @@ -1,5 +1,9 @@ # Changelog +## 4.4.21 - 2026-08-20 + +- Mise à jour des dépendances (ecrire, images) + ## 4.4.20 - 2026-08-17 - Mise à jour des dépendances (ecrire, bigup, dist) diff -Nru spip-4.4.20+dfsg/composer.lock spip-4.4.21+dfsg/composer.lock --- spip-4.4.20+dfsg/composer.lock 2026-08-17 10:07:16.000000000 +0000 +++ spip-4.4.21+dfsg/composer.lock 2026-08-20 11:46:58.000000000 +0000 @@ -317,16 +317,16 @@ }, { "name": "spip/ecrire", - "version": "4.4.20", + "version": "4.4.21", "source": { "type": "git", "url": "https://git.spip.net/spip/ecrire.git", - "reference": "74a3d926c272783d106637ab4c2371c0cc7b7ceb" + "reference": "be104d012aceda0049347121ddc2477c91a79487" }, "dist": { "type": "zip", - "url": "https://git.spip.net/api/v4/projects/spip%2Fecrire/repository/archive.zip?sha=74a3d926c272783d106637ab4c2371c0cc7b7ceb", - "reference": "74a3d926c272783d106637ab4c2371c0cc7b7ceb", + "url": "https://git.spip.net/api/v4/projects/spip%2Fecrire/repository/archive.zip?sha=be104d012aceda0049347121ddc2477c91a79487", + "reference": "be104d012aceda0049347121ddc2477c91a79487", "shasum": "" }, "require": { @@ -362,10 +362,10 @@ ], "description": "Noyau de SPIP", "support": { - "source": "https://git.spip.net/spip/ecrire/-/tree/4.4.20", + "source": "https://git.spip.net/spip/ecrire/-/tree/4.4.21", "issues": "https://git.spip.net/spip/ecrire/-/issues" }, - "time": "2026-08-17T12:03:21+02:00" + "time": "2026-08-20T13:41:29+02:00" }, { "name": "spip/prive", diff -Nru spip-4.4.20+dfsg/debian/changelog spip-4.4.21+dfsg/debian/changelog --- spip-4.4.20+dfsg/debian/changelog 2026-08-18 10:59:28.000000000 +0000 +++ spip-4.4.21+dfsg/debian/changelog 2026-08-20 12:06:22.000000000 +0000 @@ -1,3 +1,11 @@ +spip (4.4.21+dfsg-0+deb13u1) trixie-security; urgency=medium + + [ Matthieu Marcillaud ] + * build: up dependencies + * build: Version 4.4.21 + + -- David Prévot Thu, 20 Aug 2026 14:06:22 +0200 + spip (4.4.20+dfsg-0+deb13u1) trixie-security; urgency=medium [ Matthieu Marcillaud ] diff -Nru spip-4.4.20+dfsg/debian/patches/0001-Fix-created-directories-and-files-default-rights.patch spip-4.4.21+dfsg/debian/patches/0001-Fix-created-directories-and-files-default-rights.patch --- spip-4.4.20+dfsg/debian/patches/0001-Fix-created-directories-and-files-default-rights.patch 2026-08-18 10:59:15.000000000 +0000 +++ spip-4.4.21+dfsg/debian/patches/0001-Fix-created-directories-and-files-default-rights.patch 2026-08-20 12:05:21.000000000 +0000 @@ -13,7 +13,7 @@ 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ecrire/inc_version.php b/ecrire/inc_version.php -index 275485d..75248f0 100644 +index 2de3d9c..afec1cb 100644 --- a/ecrire/inc_version.php +++ b/ecrire/inc_version.php @@ -445,7 +445,7 @@ $liste_des_authentifications = [ diff -Nru spip-4.4.20+dfsg/debian/patches/0003-Fix-displayed-version-in-the-private-interface.patch spip-4.4.21+dfsg/debian/patches/0003-Fix-displayed-version-in-the-private-interface.patch --- spip-4.4.20+dfsg/debian/patches/0003-Fix-displayed-version-in-the-private-interface.patch 2026-08-18 10:59:15.000000000 +0000 +++ spip-4.4.21+dfsg/debian/patches/0003-Fix-displayed-version-in-the-private-interface.patch 2026-08-20 12:05:21.000000000 +0000 @@ -14,7 +14,7 @@ 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ecrire/inc_version.php b/ecrire/inc_version.php -index 75248f0..fa7ce7e 100644 +index afec1cb..950d443 100644 --- a/ecrire/inc_version.php +++ b/ecrire/inc_version.php @@ -470,7 +470,7 @@ $spip_sql_version = 1; diff -Nru spip-4.4.20+dfsg/ecrire/CHANGELOG.md spip-4.4.21+dfsg/ecrire/CHANGELOG.md --- spip-4.4.20+dfsg/ecrire/CHANGELOG.md 2026-08-17 10:03:20.000000000 +0000 +++ spip-4.4.21+dfsg/ecrire/CHANGELOG.md 2026-08-20 11:41:28.000000000 +0000 @@ -2,6 +2,20 @@ Changelog de SPIP 4.4 +## 4.4.21 - 2026-08-20 + +### Fixed + +- spip/spip#5802 utiliser `date()` pour émuler `DATE_FORMAT()` en sqlite +- spip/medias#5040 faire fonctionner "titre REGEXP '^$'" en sqlite +- #165 Autoriser la création du password d’un nouvel auteur +- #159 Simplifier `attribut_url()` + +### Security + +- !312 compléter `safe_export_env()` pour traiter aussi les clés de tableaux +- #167 Ne pas capturer des headers en dehors de cas prévus (issus de la balise HTTP_HEADER notamment) + ## 4.4.20 - 2026-08-17 ### Added diff -Nru spip-4.4.20+dfsg/ecrire/action/inscrire_auteur.php spip-4.4.21+dfsg/ecrire/action/inscrire_auteur.php --- spip-4.4.20+dfsg/ecrire/action/inscrire_auteur.php 2026-08-17 10:03:20.000000000 +0000 +++ spip-4.4.21+dfsg/ecrire/action/inscrire_auteur.php 2026-08-20 11:41:28.000000000 +0000 @@ -277,8 +277,12 @@ function creer_pass_pour_auteur($id_auteur) { include_spip('inc/acces'); $pass = creer_pass_aleatoire(max(_PASS_LONGUEUR_MINI, 16), $id_auteur); + include_spip('action/editer_auteur'); + include_spip('inc/autoriser'); + autoriser_exception('modifier', 'auteur', $id_auteur); auteur_instituer($id_auteur, ['pass' => $pass]); + autoriser_exception('modifier', 'auteur', $id_auteur, false); return $pass; } diff -Nru spip-4.4.20+dfsg/ecrire/inc/filtres.php spip-4.4.21+dfsg/ecrire/inc/filtres.php --- spip-4.4.20+dfsg/ecrire/inc/filtres.php 2026-08-17 10:03:20.000000000 +0000 +++ spip-4.4.21+dfsg/ecrire/inc/filtres.php 2026-08-20 11:41:28.000000000 +0000 @@ -1396,33 +1396,6 @@ ); } - -/** - * Rend une URL utilisable sans dommage comme attribut d'une balise HTML - * - * @example `#TITRE` - * - * @filtre - * - * @param ?string $texte - * texte à mettre en attribut - * @return string - * texte prêt pour être utilisé en attribut HTML - */ -function attribut_url(?string $texte): string { - if ($texte === null || $texte === '') { - return ''; - } - $texte = entites_html($texte, false, false); - $texte = str_replace(["'", '"'], [''', '"'], $texte); - return preg_replace( - ['/&(amp;|#38;)/', '/&(?![A-Za-z]{0,4}\w{2,3};|#[0-9]{2,5};)/'], - ['&', '&'], - $texte - ); -} - - /** * Vider les URL nulles * diff -Nru spip-4.4.20+dfsg/ecrire/inc/filtres_mini.php spip-4.4.21+dfsg/ecrire/inc/filtres_mini.php --- spip-4.4.20+dfsg/ecrire/inc/filtres_mini.php 2026-08-17 10:03:20.000000000 +0000 +++ spip-4.4.21+dfsg/ecrire/inc/filtres_mini.php 2026-08-20 11:41:28.000000000 +0000 @@ -270,3 +270,30 @@ return htmlentities($string, $flags, $encoding, $double_encode); } + + +/** + * Rend une URL utilisable sans dommage comme attribut d'une balise HTML + * + * @example `#TITRE` + * + * @filtre + * + * @param ?string $texte + * texte à mettre en attribut + * @return string + * texte prêt pour être utilisé en attribut HTML + */ +function attribut_url(?string $texte): string { + if ($texte === null || $texte === '') { + return ''; + } + $texte = spip_htmlspecialchars($texte, ENT_NOQUOTES | ENT_HTML401); + $texte = preg_replace(',&(#[0-9][0-9][0-9]+;|amp;),iS', '&\1', $texte); + $texte = str_replace(["'", '"'], [''', '"'], $texte); + return preg_replace( + ['/&(amp;|#38;)/', '/&(?![A-Za-z]{0,4}\w{2,3};|#[0-9]{2,5};)/'], + ['&', '&'], + $texte + ); +} diff -Nru spip-4.4.20+dfsg/ecrire/inc/headers.php spip-4.4.21+dfsg/ecrire/inc/headers.php --- spip-4.4.20+dfsg/ecrire/inc/headers.php 2026-08-17 10:03:20.000000000 +0000 +++ spip-4.4.21+dfsg/ecrire/inc/headers.php 2026-08-20 11:41:28.000000000 +0000 @@ -41,10 +41,10 @@ $status = 302; } + include_spip('inc/filtres_mini'); $url = trim(strtr($url, "\n\r", ' ')); # si l'url de redirection est relative, on la passe en absolue if (!preg_match(',^(\w+:)?//,', $url)) { - include_spip('inc/filtres_mini'); $url = url_absolue($url); } @@ -53,7 +53,6 @@ } // ne pas laisser passer n'importe quoi dans l'url - include_spip('inc/filtres'); $url = str_replace(['<', '"'], ['<', '"'], (string) $url); $url = str_replace(["\r", "\n", ' '], ['%0D', '%0A', '%20'], $url); while (str_contains($url, '%0A')) { diff -Nru spip-4.4.20+dfsg/ecrire/inc_version.php spip-4.4.21+dfsg/ecrire/inc_version.php --- spip-4.4.20+dfsg/ecrire/inc_version.php 2026-08-17 10:03:20.000000000 +0000 +++ spip-4.4.21+dfsg/ecrire/inc_version.php 2026-08-20 11:41:28.000000000 +0000 @@ -451,8 +451,8 @@ // pour specifier les versions de SPIP necessaires // il faut s'en tenir a un nombre de decimales fixe // ex : 2.0.0, 2.0.0-dev, 2.0.0-beta, 2.0.0-beta2 -$spip_version_branche = '4.4.20'; -define('_SPIP_VERSION_ID', 40420); +$spip_version_branche = '4.4.21'; +define('_SPIP_VERSION_ID', 40421); define('_SPIP_EXTRA_VERSION', ''); // cette version dev accepte tous les plugins compatible avec la version ci-dessous diff -Nru spip-4.4.20+dfsg/ecrire/paquet.xml spip-4.4.21+dfsg/ecrire/paquet.xml --- spip-4.4.20+dfsg/ecrire/paquet.xml 2026-08-17 10:03:20.000000000 +0000 +++ spip-4.4.21+dfsg/ecrire/paquet.xml 2026-08-20 11:41:28.000000000 +0000 @@ -1,7 +1,7 @@ $value) { - $out .= "\t" . var_export($key, true) . ' => ' . safe_export_env($value) . ",\n"; + $out .= "\t" . safe_export_env($key) . ' => ' . safe_export_env($value) . ",\n"; } $out .= ']'; return $out; diff -Nru spip-4.4.20+dfsg/ecrire/req/sqlite_fonctions.php spip-4.4.21+dfsg/ecrire/req/sqlite_fonctions.php --- spip-4.4.20+dfsg/ecrire/req/sqlite_fonctions.php 2026-08-17 10:03:20.000000000 +0000 +++ spip-4.4.21+dfsg/ecrire/req/sqlite_fonctions.php 2026-08-20 11:41:28.000000000 +0000 @@ -60,7 +60,7 @@ 'COS' => ['cos', 1], // D - 'DATE_FORMAT' => ['_sqlite_func_date_format', 2], // équivalent a strftime avec args inversés + 'DATE_FORMAT' => ['_sqlite_func_date_format', 2], // équivalent a date() avec args inversés et format converti 'DAYOFMONTH' => ['_sqlite_func_dayofmonth', 1], 'DEGREES' => ['rad2deg', 1], @@ -402,7 +402,7 @@ function _sqlite_func_regexp_match($cherche, $quoi) { // optimiser un cas tres courant avec les requetes en base if (!$quoi and !strlen($quoi)) { - return false; + return ($cherche === '^$' ? true : false); } // il faut enlever un niveau d'echappement pour être homogène à mysql $cherche = str_replace('\\\\', '\\', $cherche); @@ -417,53 +417,78 @@ /** * Mapping de `DATE_FORMAT` pour SQLite * - * Transforme un un appel à DATE_FORMAT() via strftime de PHP, mais les motifs de remplacements - * ne sont pas toujours identiques. On essaie de les contertir. + * Transforme un un appel à DATE_FORMAT() via date() de PHP, + * mais les chaines de format n'ont pas toujours un équivalent + * On fait au mieux. * * @param string $date * @param string $conv * @return string */ function _sqlite_func_date_format($date, $conv) { - $conv = _sqlite_func_strftime_format_converter($conv); - return strftime($conv, is_int($date) ? $date : strtotime($date)); + $conv = _sqlite_func_date_format_converter($conv); + return date($conv, is_int($date) ? $date : strtotime($date)); } /** * Convertit un format demandé pour DATE_FORMAT() de mysql en un format - * adapté à strftime() de php. + * adapté à date() de php. * * Certains paramètres ne correspondent pas et doivent être remplacés, - * d'autres n'ont tout simplement pas d'équivalent dans strftime : + * d'autres n'ont tout simplement pas d'équivalent dans date() : * dans ce cas là on loggue, car il y a de grandes chances que le résultat * soit inadapté. * * @param string $conv * @return void */ -function _sqlite_func_strftime_format_converter(string $conv): string { - // ok : %a %b %d %e %H %I %l %j %k %m %p %r %S %T %w %y %Y +function _sqlite_func_date_format_converter(string $conv): string { + // ok : %a %b %d %e %H %I %l w%j %k %m %p %r %S %T %w %y %Y // on ne sait pas en gérer certains... - static $mysql_to_strftime_not_ok = ['%c', '%D', '%f', '%U', '%V', '%W', '%X']; - static $mysql_to_strftime = [ - '%h' => '%I', - '%i' => '%M', - '%M' => '%B', - '%s' => '%S', - '%u' => '%U', - '%v' => '%V', - '%x' => '%G', + static $mysql_to_php_date_not_ok = ['%j', '%U', '%u', '%V', '%X']; + $mysql_to_php_date = [ + '%a' => 'D', // Abbreviated weekday name (Sun to Sat) + '%b' => 'M', // Abbreviated month name (Jan to Dec) + '%c' => 'n', // Numeric month name (0 to 12) + '%D' => 'jS', // Day of the month as a numeric value, followed by suffix (1st, 2nd, 3rd, ...) + '%d' => 'd', // Day of the month as a numeric value (01 to 31) + '%e' => 'j', // Day of the month as a numeric value (0 to 31) + '%f' => 'u', // Microseconds (000000 to 999999) + '%H' => 'H', // Hour (00 to 23) + '%h' => 'h', // Hour (00 to 12) + '%I' => 'h', // Hour (00 to 12) + '%i' => 'i', // Minutes (00 to 59) + '%j' => '??', //Approx 'z', // Day of the year (SQL:001 to 366 | PHP:000 to 365) + '%k' => 'G', // Hour (0 to 23) + '%l' => 'g', // Hour (1 to 12) + '%M' => 'F', // Month name in full (January to December) + '%m' => 'm', // Month name as a numeric value (00 to 12) + '%p' => 'A', // AM or PM + '%r' => 'h:i:s A', // Time in 12 hour AM or PM format (hh:mm:ss AM/PM) + '%S' => 's', // Seconds (00 to 59) + '%s' => 's', // Seconds (00 to 59) + '%T' => 'H:i:s', // Time in 24 hour format (hh:mm:ss) + '%U' => '??', // Week where Sunday is the first day of the week (00 to 53) + '%u' => '??', // Approx 'W', // Week where Monday is the first day of the week (00 to 53) + '%V' => '??', // Week where Sunday is the first day of the week (01 to 53). Used with %X + '%v' => 'W', // Week where Monday is the first day of the week (01 to 53). Used with %x + '%W' => 'l', // Weekday name in full (Sunday to Saturday) + '%w' => 'w', // Day of the week where Sunday=0 and Saturday=6 + '%X' => '??', // Year for the week where Sunday is the first day of the week. Used with %V + '%x' => 'o', // Year for the week where Monday is the first day of the week. Used with %v + '%Y' => 'Y', // Year as a numeric, 4-digit value + '%y' => 'y', // Year as a numeric, 2-digit value ]; - static $to_strftime = []; - if (!isset($to_strftime[$conv])) { + static $to_php_date = []; + if (!isset($to_php_date[$conv])) { + $to_php_date[$conv] = str_replace(array_keys($mysql_to_php_date), $mysql_to_php_date, $conv); $count = 0; - str_replace($mysql_to_strftime_not_ok, '', $conv, $count); + str_replace($mysql_to_php_date_not_ok, '', $conv, $count); if ($count > 0) { - spip_log("DATE_FORMAT : At least one parameter can't be parsed by strftime with format '$conv'", 'sqlite.' . _LOG_ERREUR); + spip_log("DATE_FORMAT : At least one parameter can't be parsed by php date() with format '$conv' => '" .$to_php_date[$conv] . "'", 'sqlite.' . _LOG_ERREUR); } - $to_strftime[$conv] = str_replace(array_keys($mysql_to_strftime), $mysql_to_strftime, $conv); } - return $to_strftime[$conv]; + return $to_php_date[$conv]; } /** diff -Nru spip-4.4.20+dfsg/plugins-dist/filtres_images/CHANGELOG.md spip-4.4.21+dfsg/plugins-dist/filtres_images/CHANGELOG.md --- spip-4.4.20+dfsg/plugins-dist/filtres_images/CHANGELOG.md 2026-08-17 10:07:18.000000000 +0000 +++ spip-4.4.21+dfsg/plugins-dist/filtres_images/CHANGELOG.md 2026-08-20 11:47:00.000000000 +0000 @@ -1,5 +1,11 @@ # Changelog +## 4.3.11 - 2026-08-20 + +### Fixed + +- inclusion manquante pour svg_charger ou svg_ajouter_background + ## 4.3.10 - 2026-08-12 ### Fixed diff -Nru spip-4.4.20+dfsg/plugins-dist/filtres_images/filtres/images_transforme.php spip-4.4.21+dfsg/plugins-dist/filtres_images/filtres/images_transforme.php --- spip-4.4.20+dfsg/plugins-dist/filtres_images/filtres/images_transforme.php 2026-08-17 10:07:18.000000000 +0000 +++ spip-4.4.21+dfsg/plugins-dist/filtres_images/filtres/images_transforme.php 2026-08-20 11:47:00.000000000 +0000 @@ -135,6 +135,9 @@ $creer = $image['creer']; if ($creer) { if ($image['format_source'] === 'svg') { + if (!function_exists('svg_charger')) { + include_spip('inc/svg'); + } if ($transparence) { $svg = svg_charger($im); } else { diff -Nru spip-4.4.20+dfsg/plugins-dist/filtres_images/paquet.xml spip-4.4.21+dfsg/plugins-dist/filtres_images/paquet.xml --- spip-4.4.20+dfsg/plugins-dist/filtres_images/paquet.xml 2026-08-17 10:07:18.000000000 +0000 +++ spip-4.4.21+dfsg/plugins-dist/filtres_images/paquet.xml 2026-08-20 11:47:00.000000000 +0000 @@ -1,7 +1,7 @@ array( 'name' => 'spip/spip', - 'pretty_version' => '4.4.20', - 'version' => '4.4.20.0', - 'reference' => '5df7fea151a21dccafc8ea16c78222f0aa2a68e0', + 'pretty_version' => '4.4.21', + 'version' => '4.4.21.0', + 'reference' => 'cb90dd9f41974d19a1b3c2a0055032d9f286d0d7', 'type' => 'project', 'install_path' => __DIR__ . '/../../', 'aliases' => array(), @@ -71,9 +71,9 @@ 'dev_requirement' => false, ), 'spip/ecrire' => array( - 'pretty_version' => '4.4.20', - 'version' => '4.4.20.0', - 'reference' => '74a3d926c272783d106637ab4c2371c0cc7b7ceb', + 'pretty_version' => '4.4.21', + 'version' => '4.4.21.0', + 'reference' => 'be104d012aceda0049347121ddc2477c91a79487', 'type' => 'spip-ecrire', 'install_path' => __DIR__ . '/../../ecrire', 'aliases' => array(), @@ -98,9 +98,9 @@ 'dev_requirement' => false, ), 'spip/spip' => array( - 'pretty_version' => '4.4.20', - 'version' => '4.4.20.0', - 'reference' => '5df7fea151a21dccafc8ea16c78222f0aa2a68e0', + 'pretty_version' => '4.4.21', + 'version' => '4.4.21.0', + 'reference' => 'cb90dd9f41974d19a1b3c2a0055032d9f286d0d7', 'type' => 'project', 'install_path' => __DIR__ . '/../../', 'aliases' => array(),