Please update to 3.0.3 to fix security vulnerabilities

[Jonathan Kolberg]

As noted in the Changelog ( http://owncloud.org/releases/Changelog ) [the 2012.3 is the enterprice name of 3.0.3) there were security issues fixed.

My reason for wanting to get 3.0.3 in and not backporting the fixes is, that there only was bugfixing done and that makes the software work much better.

[Jonathan Kolberg (bulldog98)]

I already have an updated package (at http://people.ubuntu.com/~bulldog98/packaging/owncloud/)

[Jamie Strandboge (jdstrand)]

Thank you for using Ubuntu and filing a bug.

Thank you for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. I see that you have attached a link to update the Ubuntu packages to the new upstream version. While this work is appreciated, we cannot publish your patches because this does not follow Ubuntu's policy of backporting security patches. If you are able, perhaps you could prepare debdiffs to fix this by following https://wiki.ubuntu.com/SecurityUpdateProcedures.

[papukaija (papukaija)]

The tag "upgrade-software-version " is not appropiate for security issues.

[Jeremy Bícha (jbicha)]

This bug was fixed in the package owncloud - 4.0.1debian-2

---------------
owncloud (4.0.1debian-2) unstable; urgency=low

  * Upload to fix PostgreSQL-related install issues.
  * debian/control:
    - Removed the postgresql-client-8.1 install alternative, just depend on
      postgresql-client.
    - Changed the postgresql-client suggest into postgresql (i.e. the server).

 -- Paul van Tilburg <email address hidden> Tue, 05 Jun 2012 21:33:20 +0200

owncloud (4.0.1debian-1) unstable; urgency=low

  * New upstream bugfix release.
  * debian/control: replaced suggest on postgresql-server by
    postgresql-client for the owncloud-pgsql package.
  * debian/owncloud-pgsql.README.Debian: updated to not mention admin
    credentials, users won't get them during the postgres install process.
  * debian/patches:
    - Dropped 04_fix_odfviewer.diff and
      06_add_head_support_for_download.diff; applied by upstream.
    - Updated 05_no_app_store.diff to only check whether the /apps dir is
      writable when the appstore is enabled.
  * debian/rules:
    - Don't install l10n/init.sh.
    - Make sure that /etc/owncloud/htaccess is owned by www-data, as
      ownCloud may update it (for now).

 -- Paul van Tilburg <email address hidden> Tue, 05 Jun 2012 00:44:46 +0200

owncloud (4.0.0debian-3) unstable; urgency=low

  * Upload to unstable.

 -- Paul van Tilburg <email address hidden> Sun, 03 Jun 2012 17:38:46 +0200

owncloud (4.0.0debian-2) experimental; urgency=low

  [ Paul van Tilburg ]
  * debian/control:
    - Set the team as maintainer.
    - Added a depend on php5-curl; this is needed by the bookmarks app,
      which is an internal app.
  * debian/owncloud.links: added some missing links to vital application
    data from /var/lib/owncloud.

  [ Thomas Mueller ]
  * debian/patches:
    - 06_add_head_support_for_download.diff added to fix the ODF viewer.

 -- Paul van Tilburg <email address hidden> Sat, 26 May 2012 23:53:18 +0200

owncloud (4.0.0debian-1) experimental; urgency=low

  [ Thomas Mueller ]
  * New upstream release 4.0.0.
  * debian/postrm: remove /etc/owncloud/config.php.
  * debian/rules: remove fullcalendar.min.js & jquery.Jcrop.min.js; they
    are not used.
  * debian/patches:
    - 04_fix_odfviewer.diff added
    - 05_no_app_store.diff added

  [ Paul van Tilburg ]
  * debian/control:
    - Added owncloud-{mysql,pgsql,sqlite} dependency packages.
    - Added a depend on libphp-phpmailer.
    - Added a depend on php-getid3 (>= 1.9.3-1).
    - Bumped the libjs-jquery depend to >= 1.7.2-1.
    - Dropped the depends on dbconfig-common, debconf, and ucf; not used yet.
    - Added a recommend for exim4 | mail-transport-agent.
  * debian/copyright, debian/rules: updated for new upstream release.
  * debian/owncloud.lintian-overrides: added an override for the backup
    directory permissions.
  * debian/owncloud.postinst: updated to enable Apache's rewrite module.
  * debian/patches:
    - Refreshed patches 01_fix_data_path.diff and 02_fix_crypt.diff for new
      upstream.
    - Dropped patches 03_fix_pear_mdb2_missmatch.diff,
      04_adding_jquery_infieldlabel_js.diff,
      05_adding_jquery_fancyboxbox.diff,
      06_adding_jquery.mousew...

[Jamie Strandboge (jdstrand)]

We are closing this bug report because it lacks the information we need to investigate the problem, as described in the previous comments. Please reopen it if you can give us the missing information, and don't hesitate to submit bug reports in the future. To reopen the bug report you can click on the current status, under the Status column, and change the Status back to 'New'. Thanks again!