close
  • Mo chevron_right

    Fix for two temporary data injection security issues

    Timothée Jaussoin · pubsub.movim.eu / Movim · Tuesday, 22 October, 2019 - 19:24 edit

Two data injection security issues were just fixed on Movim master in the following commit 71fcff40d70abd84f10baa252f86eba64264e841.

Movim was not verifying the origin of two kind of XML messages (called stanza) coming from the XMPP connection. This could allow some attacker to inject, in the current client session, some hazardous data. Those data are not persistent after a session reconnection.

  • The roster items
  • The Bookmarks 2 PEP items

The Roster items security issue was left open for many years and there is no known exploit from the team of it yet. But we strongly recommend you to patch your Movim instance by adding the following line in the lib/moxl/src/Moxl/Xec/Payload/Roster.php file on line 12.

if (current(explode('/', (string)$parent->attributes()->from)) != \App\User::me()->id) return;

The Bookmark 2 PEP item issue is very similar but was only recently introduced in master with the implementation of the Bookmark 2 feature. We simply recommend to pull master and restart you Movim instance to clear the cache and remove any unwanted data.

  • Mo chevron_right

    Movim 0.15.1 in preparation, some fixes and improvements in the meantime…

    Timothée Jaussoin · pubsub.movim.eu / Movim · Friday, 23 August, 2019 - 15:15 edit

Only a few weeks after the 0.15 release, a lot of improvements were made (and bugs fixed!) in #Movim for the upcoming 0.15.1 #release. They are listed, like always, on our CHANGELOG file.

We are also working on a new exciting feature for this release. Some of you already tried it (if you're curious you'll find it already on nl.movim.eu). For the others, here's a little clue:

Got it?

We also fixed some issues in the feedcleaner and atomtopubsub projects to improve and fix some compatibility issues between the RSS/Atom streams we are parsing and the #XMPP network. Some broken links were fixed within the articles (especially for pictures and external links), article tags are now transferred and handled properly within Movim and the articles content are now sanitized directly by feedcleaner.

Tell us what you think and do not hesitate to join us on our official chatroom to discuss about the project!

That's all folks!

  • Mo chevron_right

    Movim 0.15 – Donati

    Timothée Jaussoin · pubsub.movim.eu / Movim · Sunday, 28 July, 2019 - 12:59 · 4 minutes

After months of work, Movim 0.15 is finally out!

This version was planned as a 0.14.2 but was finally retagged as a major release regarding the number of changes, improvements and new features introduced. This #release note will also sum up the changes introduced in the minor 0.14.1 version.

So what's new in Movim?

User features

Local nicknames

In the configuration panel you can now set a local nickname, this allows you to shorten the identifier you are using on your current pod and gives you a nice looking url for your blog (https://nl.movim.eu/?blog/edhelas%40movim.eu/ becomes https://nl.movim.eu/?blog/edhelas).

Chats reactions

In one-to-one chats and chatrooms you can add and remove #reactions to your contacts messages. A first implementation was using the Message Attaching XMPP extension. During the Lyon XMPP Sprint, the feature was refactored to implement the incoming XEP - Message Reactions. During this sprint we also worked with the #Dino and #Poezio developers to make the feature fully compatible with their clients.

Chat reactions

Publication sharing

You can now easily share any article found in Movim inside a conversation by clicking on the send button just bellow the article.

This uses the References XMPP extension.

Publication sharing

Snap!

Do you want to quickly snap a picture and directly send it to a friend in a discussion or in an article? The new #Snap feature allows you to do that from any devices. Switch between your different cameras, shoot and send. It's that easy!

The Android application has been updated as well to integrate this feature properly.

Small improvements

  • You can now slide a one to one discussion to close it quickly, just like the Conversations client allows you to.
  • Search navigation has been improved, there is no page reload anymore to open a new discussion from the Search panel.
  • The Community page was fully redesigned to be snappier and propose contents that might interest you.
  • The UI now handles small disconnections way better . The conversations are not fully reloaded anymore when the connection is brought back.
  • In the configuration you can now define the Chat page as the default one to open when launching Movim, this is quite useful on mobile.

Fixes, fixes, many fixes

Lots of small things were fixed here and there.

  • The chat notifications counter was fully refactored to prevent some counter issues, each message is now independently checked as read (or not) in the database
  • The composing/paused chat state are now handled more properly in Movim. Those states are also displayed during chatrooms discussions. This fixes a 3 years old ticket.
  • Websockets are now reconnected properly if the browser is doing some intensive throttling, this was especially the case on Chrome on mobile devices.

Architecture and technical changes

From ZeroMQ to Websockets

One of the biggest changes technically wise was the replacement of #ZeroMQ sockets with WebSockets. This technology was used internally for the inter-processes communications. In the end this replacement allows us to become independent from the php-zmq library without any noticeable performance impact.

This simplifies even more the deployment of Movim and helps with the packaging of the project.

New base web server directory

For the administrators, please notice that the main file, index.php is not at the root of the project anymore but in the public/ directory (as well as many other files). These small changes allow the Web server to expose only the public files without extra configuration. So please point your root repository to that public subfolder.

This change was about securing the basic setup by default .

SQLite support removed

The #SQLite support, introduced in the version 0.14, has been removed for now. We had lots of issues to maintain consistency and fix our migrations for that specific database.

Some work has been done on the Eloquent library to fix some of those migrations issues upstream but it is too early to have something sufficient to bring back SQLite support in Movim.

You can still fully use Movim with #MySQL and #PostgreSQL.

What's next?

Movim has now reached a stable state, both UX/UI wise as architecturally wise.

There is still a lot of improvements to do, especially regarding the integration between the social network part and the chat part. Plus, we are always interested to hear about new ideas or improvement suggestions!

For the 0.16 version we are planning to improve video-conferencing and bring it properly for the mobile devices. Some work is also planned to improve the Communities navigation.

We need your help

To continue developing and hosting our infrastructure and to support the project we would be really pleased to cover our monthly expenses, it's not much.

We already have a few hundreds users connected daily on our main servers. If each of them could give a few euros per month it would easily allow us to reach that goal.

You can help us by giving monthly on our official Patreon page or by using Paypal.

  • movim/movim

    Movim - Decentralized social platform. Contribute to movim/movim development by creating an account on GitHub.

  • image
  • Mo chevron_right

    Some news about Movim

    Timothée Jaussoin · pubsub.movim.eu / Movim · Tuesday, 11 June, 2019 - 16:29 edit

You may have noticed that there was less updates about Movim the past few weeks. I was indeed a bit busy with other things (jobs, other projects…) but don't worry I'm still working on the upcoming release and maintaining things up.

Our #ejabberd instance (for movim.eu and jappix.com) was updated to ejabberd 19.05 a few days ago (we also found a little issue in the release related to the #Pubsub module, which was kindly fixed upstream by the ejabberd team).

A new "share posts to chat contacts" feature was also introduced recently. This will need a bit of polishing but will be part of the upcoming release.

Posts in the chat, Movim, first XMPP client to do that, it

I am also renewing our call to help the #Movim project on #Patreon, we lost a few bakers and went again bellow the 50€/month that allows us to cover the servers + domains and few other expenses for the project.

So if you want to help us, do not hesitate to join our Patreon as well as participating to our little community by doing translations, bug reports (or better, fixes!).

edhelas