cherry-pick uri security fix

[git.ikiwiki.info.git] / IkiWiki.pm

diff --git a/IkiWiki.pm b/IkiWiki.pm
index c70307b5f299ae0955e086fd8ebeff937ac895e9..0c05bb0d377c8622b2e0ea3ff6a21abea14a6322 100644 (file)
--- a/IkiWiki.pm
+++ b/IkiWiki.pm
@@ -68,6 +68,8 @@ sub defaultconfig () { #{{{
        diffurl => '',
        rss => 0,
        atom => 0,
+       allowrss => 0,
+       allowatom => 0,
        discussion => 1,
        rebuild => 0,
        refresh => 0,
@@ -260,6 +262,12 @@ sub pagetype ($) { #{{{
        return;
 } #}}}
 
+sub isinternal ($) { #{{{
+       my $page=shift;
+       return exists $pagesources{$page} &&
+               $pagesources{$page} =~ /\._([^.]+)$/;
+} #}}}
+
 sub pagename ($) { #{{{
        my $file=shift;
 
@@ -607,33 +615,10 @@ sub htmllink ($$$;@) { #{{{
        return "<a href=\"$bestlink\"@attrs>$linktext</a>";
 } #}}}
 
-sub openiduser ($) { #{{{
-       my $user=shift;
-
-       if ($user =~ m!^https?://! &&
-           eval q{use Net::OpenID::VerifiedIdentity; 1} && !$@) {
-               my $oid=Net::OpenID::VerifiedIdentity->new(identity => $user);
-               my $display=$oid->display;
-               # Convert "user.somehost.com" to "user [somehost.com]".
-               if ($display !~ /\[/) {
-                       $display=~s/^(.*?)\.([^.]+\.[a-z]+)$/$1 [$2]/;
-               }
-               # Convert "http://somehost.com/user" to "user [somehost.com]".
-               if ($display !~ /\[/) {
-                       $display=~s/^https?:\/\/(.+)\/([^\/]+)$/$2 [$1]/;
-               }
-               $display=~s!^https?://!!; # make sure this is removed
-               eval q{use CGI 'escapeHTML'};
-               error($@) if $@;
-               return escapeHTML($display);
-       }
-       return;
-}
-
 sub userlink ($) { #{{{
        my $user=shift;
 
-       my $oiduser=openiduser($user);
+       my $oiduser=eval { openiduser($user) };
        if (defined $oiduser) {
                return "<a href=\"$user\">$oiduser</a>";
        }
@@ -901,7 +886,7 @@ sub loadindex () { #{{{
        %oldrenderedfiles=%pagectime=();
        if (! $config{rebuild}) {
                %pagesources=%pagemtime=%oldlinks=%links=%depends=
-                       %destsources=%renderedfiles=%pagecase=();
+                       %destsources=%renderedfiles=%pagecase=%pagestate=();
        }
        open (my $in, "<", "$config{wikistatedir}/index") || return;
        while (<$in>) {
@@ -967,7 +952,7 @@ sub saveindex () { #{{{
                if (exists $pagestate{$page}) {
                        foreach my $id (@hookids) {
                                foreach my $key (keys %{$pagestate{$page}{$id}}) {
-                                       $line.=' '.$id.'_'.encode_entities($key)."=".encode_entities($pagestate{$page}{$id}{$key});
+                                       $line.=' '.$id.'_'.encode_entities($key)."=".encode_entities($pagestate{$page}{$id}{$key}, " \t\n");
                                }
                        }
                }
@@ -1287,13 +1272,22 @@ sub match_glob ($$;@) { #{{{
        $glob=~s/\\\?/./g;
 
        if ($page=~/^$glob$/i) {
-               return IkiWiki::SuccessReason->new("$glob matches $page");
+               if (! IkiWiki::isinternal($page) || $params{internal}) {
+                       return IkiWiki::SuccessReason->new("$glob matches $page");
+               }
+               else {
+                       return IkiWiki::FailReason->new("$glob matches $page, but the page is an internal page");
+               }
        }
        else {
                return IkiWiki::FailReason->new("$glob does not match $page");
        }
 } #}}}
 
+sub match_internal ($$;@) { #{{{
+       return match_glob($_[0], $_[1], @_, internal => 1)
+} #}}}
+
 sub match_link ($$;@) { #{{{
        my $page=shift;
        my $link=lc(shift);
@@ -1389,19 +1383,4 @@ sub match_creation_year ($$;@) { #{{{
        }
 } #}}}
 
-sub match_user ($$;@) { #{{{
-       shift;
-       my $user=shift;
-       my %params=@_;
-
-       return IkiWiki::FailReason->new('cannot match user')
-               unless exists $params{user};
-       if ($user eq $params{user}) {
-               return IkiWiki::SuccessReason->new("user is $user")
-       }
-       else {
-               return IkiWiki::FailReason->new("user is not $user");
-       }
-} #}}}
-
 1