Author: steven Date: Fri Jan 27 22:37:07 2017 New Revision: 1780617 URL: http://svn.apache.org/viewvc?rev=1780617&view=rev Log: CB-12403: added android 6.1.2 release blog post
Added: cordova/site/public/announcements/2017/01/27/ cordova/site/public/announcements/2017/01/27/android-612.html Modified: cordova/site/public/blog/index.html cordova/site/public/feed.xml cordova/site/public/news/2017/01/23/tools-release.html cordova/site/public/sitemap.xml cordova/site/public/static/js/index.js cordova/site/public/static/js/plugins.js Added: cordova/site/public/announcements/2017/01/27/android-612.html URL: http://svn.apache.org/viewvc/cordova/site/public/announcements/2017/01/27/android-612.html?rev=1780617&view=auto ============================================================================== --- cordova/site/public/announcements/2017/01/27/android-612.html (added) +++ cordova/site/public/announcements/2017/01/27/android-612.html Fri Jan 27 22:37:07 2017 @@ -0,0 +1,309 @@ +<!DOCTYPE html> +<html lang="en"> +<head> + <meta charset="utf-8"> + <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> + <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> + <meta name="format-detection" content="telephone=no"> + <meta name="viewport" content="user-scalable=no, initial-scale=1, maximum-scale=1, minimum-scale=1, width=device-width" /> + <meta name="description" content="A Security issue was discovered incordova-android. We are releasing cordova-android@6.1.2 to address this security issue. We recommend that all Android appli..."> + + <title> + + + Apache Cordova Android 6.1.2 Released - Apache Cordova + + + </title> + + <link rel="SHORTCUT ICON" href="/favicon.ico"/> + + + + + + + <link rel="canonical" href="https://cordova.apache.org/announcements/2017/01/27/android-612.html"> + + <!-- CSS --> + <link rel="stylesheet" type="text/css" href="/static/css/main.css"> + <link rel="stylesheet" type="text/css" href="/static/css/lib/syntax.css"> + <!-- Algolia Search CSS --> + <link rel="stylesheet" href="https://cdn.jsdelivr.net/docsearch.js/1/docsearch.min.css" /> + + <!-- Fonts --> + <!-- For attribution information, see www/attributions.html --> + <link href='https://fonts.googleapis.com/css?family=Raleway:700,400,300,700italic,400italic,300italic' rel='stylesheet' type='text/css'> + + <!-- HTML5 shim and Respond.js for IE8 support of HTML5 elements and media queries --> + <!--[if lt IE 9]> + <script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script> + <script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script> + <![endif]--> + <script type="text/javascript"> + var disqus_developer = 1; // this would set it to developer mode + </script> + + <!-- JS --> + <script defer type="text/javascript" src="/static/js/lib/jquery-2.1.1.min.js"></script> + <script defer type="text/javascript" src="/static/js/lib/bootstrap.min.js"></script> + <script defer type="text/javascript" src="/static/js/lib/ZeroClipboard.js"></script> + + <script> + (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){ + (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o), + m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m) + })(window,document,'script','//www.google-analytics.com/analytics.js','ga'); + ga('create', 'UA-64283057-3', 'auto'); + ga('send', 'pageview'); +</script> + +</head> + +<body> + <header> + <a class="scroll-point pt-top" name="top"></a> + <nav class="navbar navbar-inverse navbar-fixed-top"> + <div class="container-fluid"> + <div class="navbar-header"> + <button type="button" class="navbar-toggle collapsed" data-toggle="collapse" data-target="#navbar" aria-expanded="false" aria-controls="navbar"> + <span class="sr-only">Toggle navigation</span> + <span class="icon-bar"></span> + <span class="icon-bar"></span> + <span class="icon-bar"></span> + </button> + <a class="navbar-brand" href="/"><img id="logo_top" src="/static/img/cordova-logo-newbrand.svg"/></a> + </div> + <div id="navbar" class="navbar-collapse collapse"> + <div class="nav_bar_center"> + <ul class="nav navbar-nav"> + <li > + <a href="/docs/en/latest/">Documentation</a> + </li> + <li > + <a href="/plugins">Plugins</a> + </li> + <li class="active"> + <a href="/blog" id="blog_button">Blog<span class="badge" id="new_blog_count"></span></a> + </li> + <li > + <a href="/contribute">Contribute</a> + </li> + <li> + <a href="/#getstarted">Get Started</a> + </li> + <li> + <form class="navbar-form navbar-right" id="header-search-form" role="search"> + <div class="input-group"> + + + + <input id="header-search-field" type="text" placeholder="Search '6.x' docs..." class="form-control hidden-xs" autocomplete="off"> + </div> + </form> + </li> + </ul> + </div> + </div><!--/.navbar-collapse --> + </div> + </nav> + <div id="_fixed_navbar_spacer" style="padding-top:50px"></div> +</header> + +<div class="page container"> + <div class="blog"> + <h1 class="blogHeader"> + Blog + <span class="rss"> + <img src="/static/img/subscribe.png"><a href="/feed.xml">RSS Feed</a> + </span> +</h1> + +<div class="post"> + <header> + <div class="title">Apache Cordova Android 6.1.2 Released</div> + <div class="author">By: + + <a href="https://twitter.com/stevesgill">Steve Gill</a> + + </div> + <div class="date">27 Jan 2017</div> + </header> + <section> + <div> + <p>A Security issue was discovered in<code>cordova-android</code>. We are releasing <code>cordova-android@6.1.2</code> to address this security issue. We recommend that all <strong>Android</strong> applications built using <code>cordova-android</code> be upgraded to use version <code>6.1.2</code>. Other Cordova platforms such as <strong>iOS</strong> are unaffected, and do not have an update.</p> + +<p>When using the Cordova CLI, update with the following command:</p> +<div class="highlight"><pre><code class="language-" data-lang="">cordova platform update android@6.1.2 +</code></pre></div> +<p>The security issue is <code>CVE-2017-3160</code></p> + +<p>For your convenience, the text of this CVE is included here.</p> + +<!--more--> + +<hr> + +<p>CVE-2017-3160: Gradle Distribution URL used by Cordova-Android does not use https by default</p> + +<p>Severity: +High</p> + +<p>Vendor: +The Apache Software Foundation</p> + +<p>Versions Affected: +Cordova Android (6.1.1 and below)</p> + +<p>Description: +After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build. However, since the default URI is not using https, it is vulnerable to a MiTM and the Gradle executable is not safe. The severity of this issue is high due to the fact that the build scripts immediately start a build after Gradle has been fetched.</p> + +<p>Upgrade path: +Developers who are concerned about this issue should install version 6.1.2 or higher of Cordova-Android.</p> + +<p>Mitigation Steps: +If developers are unable to install the latest version, this vulnerability can easily be mitigated by setting the CORDOVA<em>ANDROID</em>GRADLE<em>DISTRIBUTION</em>URL environment variable to https://services.gradle.org/distributions/gradle-2.14.1-all.zip</p> + +<p>Credit: +Alon Galili</p> + + </div> + </section> + <footer> + <div class="row"> + <div class="col-sm-6"> + + <a href="/news/2017/01/23/tools-release.html">Previous</a> + <br> + <br> + <a class="title" href="/news/2017/01/23/tools-release.html">Tools Released!</a> + <div class="date"> 23 Jan 2017 - By Steve Gill </div> + <p class="content"> + New updates of our tools are now available! cordova@6.5.0 cordova-lib@6.5.0 plugman@1.4.1 cordova-js@4.2.1... + </p> + + </div> + <div class="col-sm-6"> + + </div> + </div> + </footer> + <div class="disqus"> + <div id="disqus_thread"></div> +<script type="text/javascript"> + /* * * CONFIGURATION VARIABLES * * */ + var disqus_shortname = 'cordovablogs'; + + /* * * DON'T EDIT BELOW THIS LINE * * */ + (function() { + var dsq = document.createElement('script'); dsq.type = 'text/javascript'; dsq.async = true; + dsq.src = '//' + disqus_shortname + '.disqus.com/embed.js'; + (document.getElementsByTagName('head')[0] || document.getElementsByTagName('body')[0]).appendChild(dsq); + })(); +</script> +<noscript>Please enable JavaScript to view the <a href="https://disqus.com/?ref_noscript" rel="nofollow">comments powered by Disqus.</a></noscript> + + </div> +</div> + +</div> + +</div> + +<div class="blue-divider"></div> +<footer> + <div class="container"> + <div class="row"> + <div class="col-sm-9"> + <h1>More Resources</h1> + <div class="row"> + <div class="col-sm-4"> + <h2>General</h2> + <ul class="nav"> + <li> + <a target="_blank" href="https://projects.apache.org/project.html?cordova">Apache Project Page</a> + </li> + <li> + <a href="https://dist.apache.org/repos/dist/release/cordova/">Source Distribution</a> + </li> + <li> + <a target="_blank" href="http://www.apache.org/licenses/LICENSE-2.0">License</a> + </li> + <li> + <a href="/artwork">Artwork</a> + </li> + </ul> + </div> + <div class="col-sm-4"> + <h2>Development</h2> + <ul class="nav"> + <li><a target="_blank" href="https://github.com/apache?utf8=%E2%9C%93&query=cordova-">Source Code</a></li> + <li><a target="_blank" href="https://issues.apache.org/jira/browse/CB/">Issue Tracker</a></li> + <li><a target="_blank" href="http://stackoverflow.com/questions/tagged/cordova">Stack Overflow</a></li> + <li><a href="/contact">Mailing List</a></li> + <li><a href="/contribute/nightly_builds.html">Nightly builds</a></li> + </ul> + </div> + <div class="col-sm-4"> + <h2>Apache Software Foundation</h2> + <ul class="nav"> + <li> + <a target="_blank" href="http://www.apache.org/">About ASF</a> + </li> + <li> + <a target="_blank" href="http://www.apache.org/foundation/sponsorship.html">Become a Sponsor</a> + </li> + <li> + <a target="_blank" href="http://www.apache.org/foundation/thanks.html">Thanks</a> + </li> + <li> + <a target="_blank" href="http://www.apache.org/security/">Security</a> + </li> + </ul> + </div> + </div> + </div> + <div class="col-sm-3"> + <h1>Contribute</h1> + <p style="padding-top:20px"><strong>Help Cordova move forward!</strong></p> + <p>Report bugs, improve the docs, or contribute to the code.</p> + <a href="/contribute" class="btn btn-lg btn-primary"> + Learn More + </a> + <p style="padding-top:20px"> <a href="https://twitter.com/apachecordova" class="twitter-follow-button" data-show-count="false">Follow @apachecordova</a></p> + <script async defer src="https://slack.cordova.io/slackin.js"></script> + </div> +</div> +<p class="copyright_text"> + Copyright © 2012, 2013, 2015 The Apache Software Foundation, Licensed under the <a target="_blank" href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.<br/> + Apache and the Apache feather logos are <a target="_blank" href="http://www.apache.org/foundation/marks/list/">trademarks</a> of The Apache Software Foundation. + <br/> + "Raleway" font used under license. For details see the <a href="/attributions/">attributions page</a>. +</p> + + </div> +</footer> + + + <script defer type="text/javascript" src="/static/js/index.js"></script> + <script defer type="text/javascript" src="/static/js/twitter.js"></script> + + + + + + + + +<script type="text/javascript" src="https://cdn.jsdelivr.net/docsearch.js/1/docsearch.min.js"></script> +<script type="text/javascript"> + docsearch({ + apiKey: '0a916ab198bd93d031aa70611271e42e', + indexName: 'cordova', + inputSelector: '#header-search-field', + algoliaOptions: { 'facetFilters': ["version: 6.x", "language: en"] } + }); +</script> + +</body> +</html> Modified: cordova/site/public/blog/index.html URL: http://svn.apache.org/viewvc/cordova/site/public/blog/index.html?rev=1780617&r1=1780616&r2=1780617&view=diff ============================================================================== --- cordova/site/public/blog/index.html (original) +++ cordova/site/public/blog/index.html Fri Jan 27 22:37:07 2017 @@ -124,6 +124,37 @@ <li> <header> + <div class="adorner" blogTime="Fri, 27 Jan 2017 00:00:00 -0800"></div> + <h2 class="title"> + <a href="/announcements/2017/01/27/android-612.html">Apache Cordova Android 6.1.2 Released</a> + </h2> + <div class="details"> + <span class="date">27 Jan 2017</span> + - by + <span class="author"> + + <a href="https://twitter.com/stevesgill">Steve Gill</a> + + </span> + <a class="comment" href="/announcements/2017/01/27/android-612.html#disqus_thread"></a> + </div> + </header> + <section class="post-excerpt"> + <p><p>A Security issue was discovered in<code>cordova-android</code>. We are releasing <code>cordova-android@6.1.2</code> to address this security issue. We recommend that all <strong>Android</strong> applications built using <code>cordova-android</code> be upgraded to use version <code>6.1.2</code>. Other Cordova platforms such as <strong>iOS</strong> are unaffected, and do not have an update.</p> + +<p>When using the Cordova CLI, update with the following command:</p> +<div class="highlight"><pre><code class="language-" data-lang="">cordova platform update android@6.1.2 +</code></pre></div> +<p>The security issue is <code>CVE-2017-3160</code></p> + +<p>For your convenience, the text of this CVE is included here.</p> +</p> + <div><a href="/announcements/2017/01/27/android-612.html">More...</a></div> + </section> + </li> + + <li> + <header> <div class="adorner" blogTime="Mon, 23 Jan 2017 00:00:00 -0800"></div> <h2 class="title"> <a href="/news/2017/01/23/tools-release.html">Tools Released!</a> @@ -5404,7 +5435,7 @@ window.twttr = (function(d, s, id) { <script> window.onload = function(){ setTimeout(function(){ - var lastPostTime = new Date("Mon, 23 Jan 2017 00:00:00 -0800").getTime(); + var lastPostTime = new Date("Fri, 27 Jan 2017 00:00:00 -0800").getTime(); setCookie("visitTime", lastPostTime, 365); }, 2000); }; Modified: cordova/site/public/feed.xml URL: http://svn.apache.org/viewvc/cordova/site/public/feed.xml?rev=1780617&r1=1780616&r2=1780617&view=diff ============================================================================== --- cordova/site/public/feed.xml (original) +++ cordova/site/public/feed.xml Fri Jan 27 22:37:07 2017 @@ -6,11 +6,64 @@ </description> <link>https://cordova.apache.org/</link> <atom:link href="https://cordova.apache.org/feed.xml" rel="self" type="application/rss+xml"/> - <pubDate>Mon, 23 Jan 2017 20:41:20 -0800</pubDate> - <lastBuildDate>Mon, 23 Jan 2017 20:41:20 -0800</lastBuildDate> + <pubDate>Fri, 27 Jan 2017 13:41:13 -0800</pubDate> + <lastBuildDate>Fri, 27 Jan 2017 13:41:13 -0800</lastBuildDate> <generator>Jekyll v2.5.3</generator> <item> + <title>Apache Cordova Android 6.1.2 Released</title> + <description><p>A Security issue was discovered in<code>cordova-android</code>. We are releasing <code>cordova-android@6.1.2</code> to address this security issue. We recommend that all <strong>Android</strong> applications built using <code>cordova-android</code> be upgraded to use version <code>6.1.2</code>. Other Cordova platforms such as <strong>iOS</strong> are unaffected, and do not have an update.</p> + +<p>When using the Cordova CLI, update with the following command:</p> +<div class="highlight"><pre><code class="language-" data-lang="">cordova platform update android@6.1.2 +</code></pre></div> +<p>The security issue is <code>CVE-2017-3160</code></p> + +<p>For your convenience, the text of this CVE is included here.</p> + +<!--more--> + +<hr> + +<p>CVE-2017-3160: Gradle Distribution URL used by Cordova-Android does not use https by default</p> + +<p>Severity: +High</p> + +<p>Vendor: +The Apache Software Foundation</p> + +<p>Versions Affected: +Cordova Android (6.1.1 and below)</p> + +<p>Description: +After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build. However, since the default URI is not using https, it is vulnerable to a MiTM and the Gradle executable is not safe. The severity of this issue is high due to the fact that the build scripts immediately start a build after Gradle has been fetched.</p> + +<p>Upgrade path: +Developers who are concerned about this issue should install version 6.1.2 or higher of Cordova-Android.</p> + +<p>Mitigation Steps: +If developers are unable to install the latest version, this vulnerability can easily be mitigated by setting the CORDOVA<em>ANDROID</em>GRADLE<em>DISTRIBUTION</em>URL environment variable to https://services.gradle.org/distributions/gradle-2.14.1-all.zip</p> + +<p>Credit: +Alon Galili</p> +</description> + <pubDate>Fri, 27 Jan 2017 00:00:00 -0800</pubDate> + <link>https://cordova.apache.org/announcements/2017/01/27/android-612.html</link> + <guid isPermaLink="true">https://cordova.apache.org/announcements/2017/01/27/android-612.html</guid> + + <category>news</category> + + <category>releases</category> + + <category>security</category> + + + <category>announcements</category> + + </item> + + <item> <title>Tools Released!</title> <description><p>New updates of our tools are now available!</p> @@ -830,70 +883,6 @@ cordova platform update windows@4.4.3 <category>news</category> - <category>releases</category> - - - <category>announcements</category> - - </item> - - <item> - <title>Cordova Android 6.0.0 Released!</title> - <description><p>We are happy to announce a major release for<code>Cordova Android 6.0.0</code> has been released! </p> - -<p>Run the following command in your project to save your currently installed plugins into <code>config.xml</code>:</p> -<div class="highlight"><pre><code class="language-" data-lang="">cordova plugin save -</code></pre></div> -<p>To upgrade:</p> -<div class="highlight"><pre><code class="language-" data-lang="">npm install -g cordova -cd my_project -cordova platform update android@6.0.0 -</code></pre></div> -<p>To add it explicitly:</p> -<div class="highlight"><pre><code class="language-" data-lang="">cordova platform add android@6.0.0 -</code></pre></div> -<!--more--> - -<h2>What&#39;s new in Android</h2> - -<p>This release adds significant functionality, and also introduces a number -of breaking changes. Some of the changes to the code base will be of -particular interest to third party webview plugin developers.</p> - -<h4>Major Changes</h4> - -<ul> -<li>Primary bridge is the <code>EVAL_BRIDGE</code>, which tells the WebView to execute JS directly. This is more stable than the <code>ONLINE_EVENT</code> bridge</li> -<li>Full Support for <code>Android Nougat (API 24)</code></li> -<li><code>Ice Cream Sandwich Support</code> has been <strong>deprecated</strong>. Minimum Supported <strong>Android</strong> Version is <code>Jellybean (API 16/ Android 4.1)</code></li> -<li>Plugin Installation now <strong>CLEANS</strong> the build directory, this speeds up gradle build times and allows for CLI develoment to be more predictable</li> -</ul> - -<p>Changes For Third-Party <code>WebView</code> Developers:</p> - -<ul> -<li><code>executeJavascript</code> method added and is an abstract method that must be implemented</li> -<li>the <code>EVAL_BRIDGE</code> must be added to the <code>WebView</code></li> -</ul> - -<h4>Curated Changes from the Git Commit Logs, check release notes for a more complete list</h4> - -<ul> -<li><a href="https://issues.apache.org/jira/browse/CB-11083">CB-11083</a>: Fix to deal with custom frameworks with their own Gradle configuration</li> -<li><a href="https://issues.apache.org/jira/browse/CB-8722">CB-8722</a>: Move icons from drawable to mipmap</li> -<li><a href="https://issues.apache.org/jira/browse/CB-11964">CB-11964</a>: Call clean after plugin install and mock it in tests</li> -<li><a href="https://issues.apache.org/jira/browse/CB-11935">CB-11935</a>: Does a best-effort attempt to pause any processing that can be paused safely, such as animations and geolocation.</li> -<li><a href="https://issues.apache.org/jira/browse/CB-11640">CB-11640</a>: Changing requirements check to ask for Java 8</li> -<li><a href="https://issues.apahce.org/jira/browse/CB-11907">CB-11907</a>: Bumping Gradle to work with Android Studio 2.2 and the Android Gradle Plugin</li> -<li><a href="https://issues.apahce.org/jira/browse/CB-11907">CB-11078</a>: Empty string for BackgroundColor preference crashes application This closes #316</li> -</ul> -</description> - <pubDate>Mon, 24 Oct 2016 00:00:00 -0700</pubDate> - <link>https://cordova.apache.org/announcements/2016/10/24/android-release.html</link> - <guid isPermaLink="true">https://cordova.apache.org/announcements/2016/10/24/android-release.html</guid> - - <category>news</category> - <category>releases</category> Modified: cordova/site/public/news/2017/01/23/tools-release.html URL: http://svn.apache.org/viewvc/cordova/site/public/news/2017/01/23/tools-release.html?rev=1780617&r1=1780616&r2=1780617&view=diff ============================================================================== --- cordova/site/public/news/2017/01/23/tools-release.html (original) +++ cordova/site/public/news/2017/01/23/tools-release.html Fri Jan 27 22:37:07 2017 @@ -221,6 +221,26 @@ </div> <div class="col-sm-6"> + <a href="/announcements/2017/01/27/android-612.html">Next</a> + <br> + <br> + <a class="title" href="/announcements/2017/01/27/android-612.html">Apache Cordova Android 6.1.2 Released</a> + <div class="date"> 27 Jan 2017 - By Steve Gill </div> + <p class="content"> + <!-- + NOTE: + the markdownify filter is used here + because posts are rendered in sequence; + that is, the next post's content isn't + yet rendered at the time that this post + is being rendered, so page.next.excerpt + is still in Markdown and not HTML + + Reference: https://github.com/jekyll/jekyll/issues/2860 + --> + A Security issue was discovered incordova-android. We are releasing cordova-android@6.1.2 to address... + </p> + </div> </div> </footer> Modified: cordova/site/public/sitemap.xml URL: http://svn.apache.org/viewvc/cordova/site/public/sitemap.xml?rev=1780617&r1=1780616&r2=1780617&view=diff ============================================================================== --- cordova/site/public/sitemap.xml (original) +++ cordova/site/public/sitemap.xml Fri Jan 27 22:37:07 2017 @@ -4,6 +4,11 @@ <!-- posts --> <url> + <loc>https://cordova.apache.org/announcements/2017/01/27/android-612.html</loc> +</url> + + +<url> <loc>https://cordova.apache.org/news/2017/01/23/tools-release.html</loc> </url> Modified: cordova/site/public/static/js/index.js URL: http://svn.apache.org/viewvc/cordova/site/public/static/js/index.js?rev=1780617&r1=1780616&r2=1780617&view=diff ============================================================================== --- cordova/site/public/static/js/index.js (original) +++ cordova/site/public/static/js/index.js Fri Jan 27 22:37:07 2017 @@ -77,6 +77,7 @@ function checkNotification() { var dates = []; if (lastVisit != "") { + dates.push('Fri, 27 Jan 2017 00:00:00 -0800'); dates.push('Mon, 23 Jan 2017 00:00:00 -0800'); dates.push('Thu, 05 Jan 2017 00:00:00 -0800'); dates.push('Mon, 12 Dec 2016 00:00:00 -0800'); --------------------------------------------------------------------- To unsubscribe, e-mail: commits-unsubscr...@cordova.apache.org For additional commands, e-mail: commits-h...@cordova.apache.org