Bug#867310: janus-demos: please remove the google STUN server to prevent an accidental breach of privacy

[Johannes Schauer]

Package: janus-demos
Severity: wishlist
Tags: patch

Hi,

as discussed in #867293 we should not enable the google STUN server by
default. To that end I prepared an (untested) patch which removes the
google STUN server and describes the change (and how to restore the
original behaviour) in debian/janus-demos.README.Debian.

Thanks!

cheers, josch
-------------- next part --------------
diff -Nru janus-0.2.3/debian/changelog janus-0.2.3/debian/changelog
--- janus-0.2.3/debian/changelog	2017-06-12 17:22:48.000000000 +0200
+++ janus-0.2.3/debian/changelog	2017-07-05 18:13:57.000000000 +0200
@@ -1,3 +1,10 @@
+janus (0.2.3-1.1) UNRELEASED; urgency=medium
+
+  * Non-maintainer upload.
+  * Add patch which removes the default google STUN server
+
+ -- Johannes Schauer <josch at debian.org>  Wed, 05 Jul 2017 18:13:57 +0200
+
 janus (0.2.3-1) unstable; urgency=medium
 
   [ upstream ]
diff -Nru janus-0.2.3/debian/janus-demos.README.Debian janus-0.2.3/debian/janus-demos.README.Debian
--- janus-0.2.3/debian/janus-demos.README.Debian	1970-01-01 01:00:00.000000000 +0100
+++ janus-0.2.3/debian/janus-demos.README.Debian	2017-07-05 18:13:57.000000000 +0200
@@ -0,0 +1,9 @@
+The default STUN server for the janus demos used to be
+stun:stun.l.google.com:19302. That one has been removed to avoid an accidental
+breach of privacy. To restore the original behaviour set:
+
+iceServers = [{urls: "stun:stun.l.google.com:19302"}];
+
+in both html/janus.js as well as in html/janus.nojquery.js.
+
+Or, use your own custom STUN server URL.
diff -Nru janus-0.2.3/debian/patches/3000_remove_google_stun.patch janus-0.2.3/debian/patches/3000_remove_google_stun.patch
--- janus-0.2.3/debian/patches/3000_remove_google_stun.patch	1970-01-01 01:00:00.000000000 +0100
+++ janus-0.2.3/debian/patches/3000_remove_google_stun.patch	2017-07-05 18:13:57.000000000 +0200
@@ -0,0 +1,25 @@
+Description: Remove the google STUN server default
+Author: Johannes Schauer <josch at debian.org>
+
+--- janus-0.2.3.orig/html/janus.js
++++ janus-0.2.3/html/janus.js
+@@ -240,7 +240,7 @@ function Janus(gatewayCallbacks) {
+ 	}
+ 	var iceServers = gatewayCallbacks.iceServers;
+ 	if(iceServers === undefined || iceServers === null)
+-		iceServers = [{urls: "stun:stun.l.google.com:19302"}];
++		iceServers = [];
+ 	var iceTransportPolicy = gatewayCallbacks.iceTransportPolicy;
+ 	// Whether IPv6 candidates should be gathered
+ 	var ipv6Support = gatewayCallbacks.ipv6;
+--- janus-0.2.3.orig/html/janus.nojquery.js
++++ janus-0.2.3/html/janus.nojquery.js
+@@ -303,7 +303,7 @@ function Janus(gatewayCallbacks) {
+ 	}
+ 	var iceServers = gatewayCallbacks.iceServers;
+ 	if(iceServers === undefined || iceServers === null)
+-		iceServers = [{urls: "stun:stun.l.google.com:19302"}];
++		iceServers = [];
+ 	var iceTransportPolicy = gatewayCallbacks.iceTransportPolicy;
+ 	// Whether IPv6 candidates should be gathered
+ 	var ipv6Support = gatewayCallbacks.ipv6;
diff -Nru janus-0.2.3/debian/patches/series janus-0.2.3/debian/patches/series
--- janus-0.2.3/debian/patches/series	2017-06-12 16:37:50.000000000 +0200
+++ janus-0.2.3/debian/patches/series	2017-07-05 18:13:57.000000000 +0200
@@ -1,3 +1,4 @@
 1001_try_enable_docs_by_default.patch
 2001_use_snakeoil_cert.patch
 2003_use_packaged_javascript.patch
+3000_remove_google_stun.patch