From 7927692bbf13d10484757b9aa6791e3cd36e0116 Mon Sep 17 00:00:00 2001 From: Oleksandr Kuzminskyi Date: Thu, 11 Jun 2026 12:53:24 -0700 Subject: [PATCH 1/2] Harden BookStack DB_PASSWORD escaping in .env template Guard the gsub against a nil/non-string Hiera lookup with .to_s, and document why only \ $ " are escaped: those are the only characters phpdotenv (BookStack/Laravel's .env parser) treats specially inside a double-quoted value. Applied across global modules plus the development and sandbox environments. Co-Authored-By: Claude Opus 4.8 (1M context) --- debian/changelog | 6 ++++++ .../development/modules/profile/templates/bookstack/env.erb | 3 ++- .../sandbox/modules/profile/templates/bookstack/env.erb | 3 ++- modules/profile/templates/bookstack/env.erb | 3 ++- 4 files changed, 12 insertions(+), 3 deletions(-) diff --git a/debian/changelog b/debian/changelog index c002cc7..b654296 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +puppet-code (0.1.0-1build305) noble; urgency=medium + + * commit event. see changes history in git log + + -- root Thu, 11 Jun 2026 19:53:26 +0000 + puppet-code (0.1.0-1build304) noble; urgency=medium * commit event. see changes history in git log diff --git a/environments/development/modules/profile/templates/bookstack/env.erb b/environments/development/modules/profile/templates/bookstack/env.erb index 40fa59c..e1d9d9f 100644 --- a/environments/development/modules/profile/templates/bookstack/env.erb +++ b/environments/development/modules/profile/templates/bookstack/env.erb @@ -24,7 +24,8 @@ APP_URL=<%= @bookstack_app_url %> DB_HOST=<%= @bookstack_db_host %> DB_DATABASE=<%= @bookstack_db_database %> DB_USERNAME=<%= @bookstack_db_username %> -DB_PASSWORD=<%= @bookstack_db_password %> +# Escape only the chars phpdotenv treats specially inside double quotes: \ $ " +DB_PASSWORD="<%= @bookstack_db_password.to_s.gsub(/[\\$"]/) { |c| "\\#{c}" } %>" # Mail system to use # Can be 'smtp' or 'sendmail' diff --git a/environments/sandbox/modules/profile/templates/bookstack/env.erb b/environments/sandbox/modules/profile/templates/bookstack/env.erb index 40fa59c..e1d9d9f 100644 --- a/environments/sandbox/modules/profile/templates/bookstack/env.erb +++ b/environments/sandbox/modules/profile/templates/bookstack/env.erb @@ -24,7 +24,8 @@ APP_URL=<%= @bookstack_app_url %> DB_HOST=<%= @bookstack_db_host %> DB_DATABASE=<%= @bookstack_db_database %> DB_USERNAME=<%= @bookstack_db_username %> -DB_PASSWORD=<%= @bookstack_db_password %> +# Escape only the chars phpdotenv treats specially inside double quotes: \ $ " +DB_PASSWORD="<%= @bookstack_db_password.to_s.gsub(/[\\$"]/) { |c| "\\#{c}" } %>" # Mail system to use # Can be 'smtp' or 'sendmail' diff --git a/modules/profile/templates/bookstack/env.erb b/modules/profile/templates/bookstack/env.erb index 40fa59c..e1d9d9f 100644 --- a/modules/profile/templates/bookstack/env.erb +++ b/modules/profile/templates/bookstack/env.erb @@ -24,7 +24,8 @@ APP_URL=<%= @bookstack_app_url %> DB_HOST=<%= @bookstack_db_host %> DB_DATABASE=<%= @bookstack_db_database %> DB_USERNAME=<%= @bookstack_db_username %> -DB_PASSWORD=<%= @bookstack_db_password %> +# Escape only the chars phpdotenv treats specially inside double quotes: \ $ " +DB_PASSWORD="<%= @bookstack_db_password.to_s.gsub(/[\\$"]/) { |c| "\\#{c}" } %>" # Mail system to use # Can be 'smtp' or 'sendmail' From b5bc8e8dad4241d611fbfa32251fd9724951e15b Mon Sep 17 00:00:00 2001 From: Oleksandr Kuzminskyi Date: Thu, 11 Jun 2026 12:54:51 -0700 Subject: [PATCH 2/2] Raise composer install timeout to 600s for BookStack The run_composer exec can exceed Puppet's default 300s timeout when fetching BookStack's dependencies; bump it to 600s across global modules and the development and sandbox environments. Co-Authored-By: Claude Opus 4.8 (1M context) --- debian/changelog | 6 ++++++ .../modules/profile/manifests/bookstack/packages.pp | 1 + .../sandbox/modules/profile/manifests/bookstack/packages.pp | 1 + modules/profile/manifests/bookstack/packages.pp | 1 + 4 files changed, 9 insertions(+) diff --git a/debian/changelog b/debian/changelog index b654296..8b80499 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +puppet-code (0.1.0-1build306) noble; urgency=medium + + * commit event. see changes history in git log + + -- root Thu, 11 Jun 2026 19:54:53 +0000 + puppet-code (0.1.0-1build305) noble; urgency=medium * commit event. see changes history in git log diff --git a/environments/development/modules/profile/manifests/bookstack/packages.pp b/environments/development/modules/profile/manifests/bookstack/packages.pp index db2e5d7..215bd4d 100644 --- a/environments/development/modules/profile/manifests/bookstack/packages.pp +++ b/environments/development/modules/profile/manifests/bookstack/packages.pp @@ -65,6 +65,7 @@ user => $www_user, environment => ["HOME=${bookstack_root}"], command => 'composer install --no-dev', + timeout => 600, creates => "${bookstack_root}/vendor/autoload.php", require => [ Exec['extract_package'], diff --git a/environments/sandbox/modules/profile/manifests/bookstack/packages.pp b/environments/sandbox/modules/profile/manifests/bookstack/packages.pp index db2e5d7..215bd4d 100644 --- a/environments/sandbox/modules/profile/manifests/bookstack/packages.pp +++ b/environments/sandbox/modules/profile/manifests/bookstack/packages.pp @@ -65,6 +65,7 @@ user => $www_user, environment => ["HOME=${bookstack_root}"], command => 'composer install --no-dev', + timeout => 600, creates => "${bookstack_root}/vendor/autoload.php", require => [ Exec['extract_package'], diff --git a/modules/profile/manifests/bookstack/packages.pp b/modules/profile/manifests/bookstack/packages.pp index db2e5d7..215bd4d 100644 --- a/modules/profile/manifests/bookstack/packages.pp +++ b/modules/profile/manifests/bookstack/packages.pp @@ -65,6 +65,7 @@ user => $www_user, environment => ["HOME=${bookstack_root}"], command => 'composer install --no-dev', + timeout => 600, creates => "${bookstack_root}/vendor/autoload.php", require => [ Exec['extract_package'],