1 [[!template id=plugin name=po core=0 author="[[intrigeri]]"]]
4 This plugin adds support for multi-lingual wikis, translated with
5 gettext, using [po4a](http://po4a.alioth.debian.org/).
7 It depends on the Perl `Locale::Po4a::Po` library (`apt-get install po4a`).
14 A language is chosen as the "master" one, and any other supported
15 language is a "slave" one.
17 A page written in the "master" language is a "master" page. It can be
18 of any page type supported by ikiwiki, except `po`. It does not have to be
19 named a special way: migration to this plugin does not imply any page
22 Example: `bla/page.mdwn` is a "master" Markdown page written in
23 English; if `usedirs` is enabled, it is rendered as
24 `bla/page/index.en.html`, else as `bla/page.en.html`.
26 Any translation of a "master" page into a "slave" language is called
27 a "slave" page; it is written in the gettext PO format. `po` is now
28 a page type supported by ikiwiki.
30 Example: `bla/page.fr.po` is the PO "message catalog" used to
31 translate `bla/page.mdwn` into French; if `usedirs` is enabled, it is
32 rendered as `bla/page/index.fr.html`, else as `bla/page.fr.html`
41 `po_master_language` is used to set the "master" language in
42 `ikiwiki.setup`, such as:
44 po_master_language => { 'code' => 'en', 'name' => 'English' }
46 `po_slave_languages` is used to set the list of supported "slave"
49 po_slave_languages => { 'fr' => 'Français',
54 Decide which pages are translatable
55 -----------------------------------
57 The `po_translatable_pages` setting configures what pages are
58 translatable. It is a [[ikiwiki/PageSpec]], so you have lots of
59 control over what kind of pages are translatable.
61 The `.po` files are not considered as being translatable, so you don't need to
62 worry about excluding them explicitly from this [[ikiwiki/PageSpec]].
67 The `po_link_to` option in `ikiwiki.setup` is used to decide how
68 internal links should be generated, depending on web server features
69 and site-specific preferences.
71 ### Default linking behavior
73 If `po_link_to` is unset, or set to `default`, ikiwiki's default
74 linking behavior is preserved: `\[[destpage]]` links to the master
77 ### Link to current language
79 If `po_link_to` is set to `current`, `\[[destpage]]` links to the
80 `destpage`'s version written in the current page's language, if
83 - `foo/destpage/index.LL.html` if `usedirs` is enabled
84 - `foo/destpage.LL.html` if `usedirs` is disabled
86 ### Link to negotiated language
88 If `po_link_to` is set to `negotiated`, `\[[page]]` links to the
89 negotiated preferred language, *i.e.* `foo/page/`.
91 (In)compatibility notes:
93 - if `usedirs` is disabled, it does not make sense to set `po_link_to`
94 to `negotiated`; this option combination is neither implemented
96 - if the web server does not support Content Negotiation, setting
97 `po_link_to` to `negotiated` will produce a unusable website.
106 Using Apache `mod_negotiation` makes it really easy to have Apache
107 serve any page in the client's preferred language, if available.
108 This is the default Debian Apache configuration.
110 When `usedirs` is enabled, one has to set `DirectoryIndex index` for
113 Setting `DefaultLanguage LL` (replace `LL` with your default MIME
114 language code) for the wiki context can help to ensure
115 `bla/page/index.en.html` is served as `Content-Language: LL`.
120 lighttpd unfortunately does not support content negotiation.
122 **FIXME**: does `mod_magnet` provide the functionality needed to
132 The `ISTRANSLATION` and `ISTRANSLATABLE` variables can be used to
133 display things only on translatable or translation pages.
135 ### Display page's versions in other languages
137 The `OTHERLANGUAGES` loop provides ways to display other languages'
138 versions of the same page, and the translations' status.
140 One typically adds the following code to `templates/page.tmpl`:
142 <TMPL_IF NAME="OTHERLANGUAGES">
143 <div id="otherlanguages">
145 <TMPL_LOOP NAME="OTHERLANGUAGES">
147 <a href="<TMPL_VAR NAME="URL">"><TMPL_VAR NAME="LANGUAGE"></a>
148 <TMPL_UNLESS NAME="MASTER">
149 (<TMPL_VAR NAME="PERCENT"> %)
157 The following variables are available inside the loop (for every page in):
159 - `URL` - url to the page
160 - `CODE` - two-letters language code
161 - `LANGUAGE` - language name (as defined in `po_slave_languages`)
162 - `MASTER` - is true (1) if, and only if the page is a "master" page
163 - `PERCENT` - for "slave" pages, is set to the translation completeness, in percents
165 ### Display the current translation status
167 The `PERCENTTRANSLATED` variable is set to the translation
168 completeness, expressed in percent, on "slave" pages.
170 One can use it this way:
172 <TMPL_IF NAME="ISTRANSLATION">
173 <div id="percenttranslated">
174 <TMPL_VAR NAME="PERCENTTRANSLATED">
178 Additional PageSpec tests
179 -------------------------
181 This plugin enhances the regular [[ikiwiki/PageSpec]] syntax with some
182 additional tests that are documented [[here|ikiwiki/pagespec/po]].
184 Automatic PO file update
185 ------------------------
187 Committing changes to a "master" page:
189 1. updates the POT file and the PO files for the "slave" languages;
190 the updated PO files are then put under version control;
191 2. triggers a refresh of the corresponding HTML slave pages.
193 Also, when the plugin has just been enabled, or when a page has just
194 been declared as being translatable, the needed POT and PO files are
195 created, and the PO files are checked into version control.
200 Discussion should happen in the language in which the pages are
201 written for real, *i.e.* the "master" one. If discussion pages are
202 enabled, "slave" pages therefore link to the "master" page's
208 One can edit the PO files using ikiwiki's CGI (a message-by-message
209 interface could also be implemented at some point).
211 If [[tips/untrusted_git_push]] is setup, one can edit the PO files in one's
212 preferred `$EDITOR`, without needing to be online.
222 The only past security issues I could find in GNU gettext and po4a
225 - [CVE-2004-0966](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0966),
226 *i.e.* [Debian bug #278283](http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278283):
227 the autopoint and gettextize scripts in the GNU gettext package
228 1.14 and later versions, as used in Trustix Secure Linux 1.5
229 through 2.1 and other operating systems, allows local users to
230 overwrite files via a symlink attack on temporary files.
231 - [CVE-2007-4462](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4462):
232 `lib/Locale/Po4a/Po.pm` in po4a before 0.32 allows local users to
233 overwrite arbitrary files via a symlink attack on the
234 gettextization.failed.po temporary file.
236 **FIXME**: check whether this plugin would have been a possible attack
237 vector to exploit these vulnerabilities.
239 Depending on my mood, the lack of found security issues can either
240 indicate that there are none, or reveal that no-one ever bothered to
241 find (and publish) them.
245 Can any sort of directives be put in po files that will cause mischief
246 (ie, include other files, run commands, crash gettext, whatever)?
248 > No [documented](http://www.gnu.org/software/gettext/manual/gettext.html#PO-Files)
249 > directive is supposed to do so. [[--intrigeri]]
251 ### Running po4a on untrusted content
253 Are there any security issues on running po4a on untrusted content?
255 To say the least, this issue is not well covered, at least publicly:
257 - the documentation does not talk about it;
258 - grep'ing the source code for `security` or `trust` gives no answer.
260 On the other hand, a po4a developer answered my questions in
261 a convincing manner, stating that processing untrusted content was not
262 an initial goal, and analysing in detail the possible issues.
266 - the core (`Po.pm`, `Transtractor.pm`) should be safe
267 - po4a source code was fully checked for other potential symlink
268 attacks, after discovery of one such issue
269 - the only external program run by the core is `diff`, in `Po.pm` (in
270 parts of its code we don't use)
271 - `Locale::gettext`: only used to display translated error messages
272 - Nicolas François "hopes" `DynaLoader` is safe, and has "no reason to
273 think that `Encode` is not safe"
274 - Nicolas François has "no reason to think that `Encode::Guess` is not
275 safe". The po plugin nevertheless avoids using it by defining the
276 input charset (`file_in_charset`) before asking `Transtractor` to
277 read any file. NB: this hack depends on po4a internals to stay
282 ##### Locale::Po4a modules
284 - the modules we want to use have to be checked, as not all are safe
285 (e.g. the LaTeX module's behaviour is changed by commands included
286 in the content); they may use regexps generated from the content; we
287 currently only use the `Text` module
288 - the `Text` module does not run any external program
289 - check that no module is loaded by `Chooser.pm`, when we tell it to
291 - `nsgmls` is used by `Sgml.pm`
295 `Text::WrapI18N` can cause DoS (see the
296 [Debian bug #470250](http://bugs.debian.org/470250)), but it is
297 optional and we do not need the features it provides.
299 It is loaded if available by `Locale::Po4a::Common`; looking at the
300 code, I'm not sure we can prevent this at all, but maybe some symbol
301 table manipulation tricks could work; overriding
302 `Locale::Po4a::Common::wrapi18n` may be easier. I'm no expert at all
303 in this field. Joey? [[--intrigeri]]
307 `Term::ReadKey` is not a hard dependency in our case, *i.e.* po4a
308 works nicely without it. But the po4a Debian package recommends
309 `libterm-readkey-perl`, so it will probably be installed on most
310 systems using the po plugin.
312 If `$ENV{COLUMNS}` is not set, `Locale::Po4a::Common` uses
313 `Term::ReadKey::GetTerminalSize()` to get the terminal size. How safe
316 Part of `Term::ReadKey` is written in C. Depending on the runtime
317 platform, this function use ioctl, environment, or C library function
318 calls, and may end up running the `resize` command (without
321 IMHO, using Term::ReadKey has too far reaching implications for us to
322 be able to guarantee anything wrt. security. Since it is anyway of no
323 use in our case, I suggest we define `ENV{COLUMNS}` before loading
324 `Locale::Po4a::Common`, just to be on the safe side. Joey?
329 `refreshpofiles()` runs this external program. A po4a developer
330 answered he does "not expect any security issues from it".
334 I was not able to find any public information about gettext or po4a
335 having been tested with a fuzzing program, such as `zzuf` or `fusil`.
336 Moreover, some gettext parsers seem to be quite
337 [easy to crash](http://fusil.hachoir.org/trac/browser/trunk/fuzzers/fusil-gettext),
338 so it might be useful to bang msgmerge/po4a's heads against such
339 a program in order to easily detect some of the most obvious DoS.
342 > po4a was not fuzzy-tested, but according to one of its developers,
343 > "it would be really appreciated". [[--intrigeri]]
345 gettext/po4a rough corners
346 --------------------------
348 - fix infinite loop when synchronizing two ikiwiki (when checkouts
349 live in different directories): say bla.fr.po has been updated in
350 repo2; pulling repo2 from repo1 seems to trigger a PO update, that
351 changes bla.fr.po in repo1; then pushing repo1 to repo2 triggers
352 a PO update, that changes bla.fr.po in repo2; etc.; quickly fixed in
353 `629968fc89bced6727981c0a1138072631751fee`, by disabling references
354 in Pot files. Using `Locale::Po4a::write_if_needed` might be
355 a cleaner solution. (warning: this function runs the external
356 `diff` program, have to check security)
357 - new translations created in the web interface must get proper
358 charset/encoding gettext metadata, else the next automatic PO update
359 removes any non-ascii chars; possible solution: put such metadata
360 into the Pot file, and let it propagate; should be fixed in
361 `773de05a7a1ee68d2bed173367cf5e716884945a`, time will tell.
368 Use nice page titles from meta plugin in links, as inline already
369 does. This is actually a duplicate for
370 [[bugs/pagetitle_function_does_not_respect_meta_titles]], which might
371 be fixed by something like [[todo/using_meta_titles_for_parentlinks]].
373 ### source files format
375 Markdown is supported, great, but what about others? The set of file
376 formats supported both in ikiwiki and po4a probably is greater than
377 `{markdown}`. Warning: the po4a modules are the place where one can
378 expect security issues.
380 Translation quality assurance
381 -----------------------------
383 Modifying a PO file via the CGI must be forbidden if the new version
384 is not a valid PO file. As a bonus, check that it provides a more
385 complete translation than the existing one.
387 A new `cansave` type of hook would be needed to implement this.
389 Note: committing to the underlying repository is a way to bypass