improve fix for symlink attacks to check subdirectories for symlinks too

[git.ikiwiki.info.git] / ikiwiki

diff --git a/ikiwiki b/ikiwiki
index 7a16be3ca907a411d907dd467985b289e05434de..b1bc9984f2bd9475787808d65f886424c250e7cc 100755 (executable)
--- a/ikiwiki
+++ b/ikiwiki
@@ -18,7 +18,7 @@ sub usage () { #{{{
 sub getconfig () { #{{{
        if (! exists $ENV{WRAPPED_OPTIONS}) {
                %config=(
-                       wiki_file_prune_regexp => qr{((^|/).svn/|\.\.|^\.|\/\.|\.html?$)},
+                       wiki_file_prune_regexp => qr{((^|/).svn/|\.\.|^\.|\/\.|\.html?$|\.rss$)},
                        wiki_link_regexp => qr/\[\[(?:([^\s\]\|]+)\|)?([^\s\]]+)\]\]/,
                        wiki_processor_regexp => qr/\[\[(\w+)\s+([^\]]+)\]\]/,
                        wiki_file_regexp => qr/(^[-A-Za-z0-9_.:\/+]+$)/,
@@ -41,6 +41,7 @@ sub getconfig () { #{{{
                        srcdir => undef,
                        destdir => undef,
                        templatedir => "/usr/share/ikiwiki/templates",
+                       underlaydir => "/usr/share/ikiwiki/basewiki",
                        setup => undef,
                        adminuser => undef,
                );
@@ -71,6 +72,9 @@ sub getconfig () { #{{{
                        "templatedir=s" => sub {
                                $config{templatedir}=possibly_foolish_untaint($_[1])
                        },
+                       "underlaydir=s" => sub {
+                               $config{underlaydir}=possibly_foolish_untaint($_[1])
+                       },
                        "wrapper:s" => sub {
                                $config{wrapper}=$_[1] ? $_[1] : "ikiwiki-wrap"
                        },
@@ -176,6 +180,14 @@ sub htmlpage ($) { #{{{
        return $page.".html";
 } #}}}
 
+sub srcfile ($) { #{{{
+       my $file=shift;
+
+       return "$config{srcdir}/$file" if -e "$config{srcdir}/$file";
+       return "$config{underlaydir}/$file" if -e "$config{underlaydir}/$file";
+       error("internal error: $file cannot be found");
+} #}}}
+
 sub readfile ($) { #{{{
        my $file=shift;
 
@@ -190,15 +202,20 @@ sub readfile ($) { #{{{
        return $ret;
 } #}}}
 
-sub writefile ($$) { #{{{
-       my $file=shift;
+sub writefile ($$$) { #{{{
+       my $file=shift; # can include subdirs
+       my $destdir=shift; # directory to put file in
        my $content=shift;
        
-       if (-l $file) {
-               error("cannot write to a symlink ($file)");
+       my $test=$file;
+       while (length $test) {
+               if (-l "$destdir/$test") {
+                       error("cannot write to a symlink ($test)");
+               }
+               $test=dirname($test);
        }
 
-       my $dir=dirname($file);
+       my $dir=dirname("$destdir/$file");
        if (! -d $dir) {
                my $d="";
                foreach my $s (split(m!/+!, $dir)) {
@@ -209,7 +226,7 @@ sub writefile ($$) { #{{{
                }
        }
        
-       open (OUT, ">$file") || error("failed to write $file: $!");
+       open (OUT, ">$destdir/$file") || error("failed to write $destdir/$file: $!");
        print OUT $content;
        close OUT;
 } #}}}