search

TYPO3-Caretaker / caretaker

TYPO3 extension caretaker
https://extensions.typo3.org/extension/caretaker/
26 stars 23 forks source link

Fix/latest versions security #88

Open etobi opened 7 years ago

etobi commented 7 years ago

I did refactor Jorgen/Jigals patch from #76 and added a basic unit test.

As I didnt get the intention of the "$major > $latestLts" comparsion, I just removed that part.

Also, if a major version just has regular releases, but no security releases yet, the "latest security" version would fallback to the PATCH version ".0".

etobi commented 7 years ago

@jvanderkroon could you please review this new patch to make sure it matches your initial intention?

etobi commented 7 years ago

also related to #63 and https://github.com/TYPO3-Caretaker/caretaker_instance/pull/56

etobi commented 7 years ago

NOT NOT MERGE (yet)

Jigal suggested some changes/additions via mail and i'm going to add some more tests to cover thoses cases.

IchHabRecht commented 7 years ago

See https://github.com/IchHabRecht/caretaker/commit/01c8e800e1f136f8197da21d97c42134d7bdf4e0

etobi commented 7 years ago

Jigals comment about the versioning

For the major version > latestLTS:

  • only the latest minor version gets security releases
  • if a new minor version is released that may contain security fixes
  • security fixes are not applied to earlier minor versions So, if a new minor version is released it should be counted as the latest security release.

For major versions <= latestLTS

  • major and minor versions are fixed
  • the latest bugfix release that is marked as security release is the latest security release for that major version
  • if no bugfix release is marked as security release then the x.x.0 version should be counted as latest security release
etobi commented 7 years ago

i'm going to extend the tests to cover these cases. WIP