Fix XSS in openid selector. Thanks, Raghav Bisht.

[git.ikiwiki.info.git] / IkiWiki / UserInfo.pm

diff --git a/IkiWiki/UserInfo.pm b/IkiWiki/UserInfo.pm
index a944cafa6791e84a1ec9fb35a39761776dceda91..0bf100a959c934d23c8f73ac1f0962f856732a35 100644 (file)
--- a/IkiWiki/UserInfo.pm
+++ b/IkiWiki/UserInfo.pm
@@ -1,27 +1,34 @@
 #!/usr/bin/perl
 
 #!/usr/bin/perl
 

+package IkiWiki;
+

 use warnings;
 use strict;
 use Storable;
 use IkiWiki;
 
 use warnings;
 use strict;
 use Storable;
 use IkiWiki;
 

-package IkiWiki;
-
-sub userinfo_retrieve () { #{{{
+sub userinfo_retrieve () {

        my $userinfo=eval{ Storable::lock_retrieve("$config{wikistatedir}/userdb") };
        return $userinfo;
        my $userinfo=eval{ Storable::lock_retrieve("$config{wikistatedir}/userdb") };
        return $userinfo;

-} #}}}
-       
-sub userinfo_store ($) { #{{{
+}
+
+sub userinfo_store ($) {

        my $userinfo=shift;
        
        my $userinfo=shift;
        

+       my $newfile="$config{wikistatedir}/userdb.new";

        my $oldmask=umask(077);
        my $oldmask=umask(077);

-       my $ret=Storable::lock_store($userinfo, "$config{wikistatedir}/userdb");
+       my $ret=Storable::lock_nstore($userinfo, $newfile);

        umask($oldmask);
        umask($oldmask);

+       if (defined $ret && $ret) {
+               if (! rename($newfile, "$config{wikistatedir}/userdb")) {
+                       unlink($newfile);
+                       $ret=undef;
+               }
+       }

        return $ret;
        return $ret;

-} #}}}
-       
-sub userinfo_get ($$) { #{{{
+}
+
+sub userinfo_get ($$) {

        my $user=shift;
        my $field=shift;
 
        my $user=shift;
        my $field=shift;
 


@@ -32,9 +39,9 @@ sub userinfo_get ($$) { #{{{
                return "";
        }
        return $userinfo->{$user}->{$field};
                return "";
        }
        return $userinfo->{$user}->{$field};

-} #}}}
+}

 
 

-sub userinfo_set ($$$) { #{{{
+sub userinfo_set ($$$) {

        my $user=shift;
        my $field=shift;
        my $value=shift;
        my $user=shift;
        my $field=shift;
        my $value=shift;


@@ -47,9 +54,9 @@ sub userinfo_set ($$$) { #{{{
        
        $userinfo->{$user}->{$field}=$value;
        return userinfo_store($userinfo);
        
        $userinfo->{$user}->{$field}=$value;
        return userinfo_store($userinfo);

-} #}}}
+}

 
 

-sub userinfo_setall ($$) { #{{{
+sub userinfo_setall ($$) {

        my $user=shift;
        my $info=shift;
        
        my $user=shift;
        my $info=shift;
        


@@ -59,35 +66,12 @@ sub userinfo_setall ($$) { #{{{
        }
        $userinfo->{$user}=$info;
        return userinfo_store($userinfo);
        }
        $userinfo->{$user}=$info;
        return userinfo_store($userinfo);

-} #}}}
+}

 
 

-sub is_admin ($) { #{{{
+sub is_admin ($) {

        my $user_name=shift;
 
        return grep { $_ eq $user_name } @{$config{adminuser}};
        my $user_name=shift;
 
        return grep { $_ eq $user_name } @{$config{adminuser}};

-} #}}}
-
-sub commit_notify_list ($@) { #{{{
-       my $committer=shift;
-       
-       my @pages;
-       foreach my $file (@_) {
-               push @pages, grep { $pagesources{$_} eq $file } keys %pagesources;
-       }
-       
-       my @ret;
-       my $userinfo=userinfo_retrieve();
-       foreach my $user (keys %{$userinfo}) {
-               next if $user eq $committer;
-               if (exists $userinfo->{$user}->{subscriptions} &&
-                   length $userinfo->{$user}->{subscriptions} &&
-                   exists $userinfo->{$user}->{email} &&
-                   length $userinfo->{$user}->{email} &&
-                   grep { pagespec_match($_, $userinfo->{$user}->{subscriptions}) } @pages) {
-                       push @ret, $userinfo->{$user}->{email};
-               }
-       }
-       return @ret;
-} #}}}
+}

 
 1
 
 1