CGI, attachment, passwordauth: harden against repeated parameters

[git.ikiwiki.info.git] / IkiWiki / Plugin / remove.pm

diff --git a/IkiWiki/Plugin/remove.pm b/IkiWiki/Plugin/remove.pm
index 14ac01c9bcfc390f370f1a8fca74c3b51d7f0baa..6875844a32fc61a67a7d6eae82c4ed684e2681df 100644 (file)
--- a/IkiWiki/Plugin/remove.pm
+++ b/IkiWiki/Plugin/remove.pm
@@ -22,6 +22,14 @@ sub getsetup () {
                },
 }
 
                },
 }
 

+sub allowed_dirs {
+       no warnings 'once';
+       return grep { defined $_ } (
+               $config{srcdir},
+               $IkiWiki::Plugin::transient::transientdir,
+       );
+}
+

 sub check_canremove ($$$) {
        my $page=shift;
        my $q=shift;
 sub check_canremove ($$$) {
        my $page=shift;
        my $q=shift;


@@ -33,12 +41,22 @@ sub check_canremove ($$$) {
                        htmllink("", "", $page, noimageinline => 1)));
        }
 
                        htmllink("", "", $page, noimageinline => 1)));
        }
 

-       # Must exist on disk, and be a regular file.
+       # Must exist in either the srcdir or a suitable underlay (e.g.
+       # transient underlay), and be a regular file.

        my $file=$pagesources{$page};
        my $file=$pagesources{$page};

-       if (! -e "$config{srcdir}/$file") {
+       my $dir;
+
+       foreach my $srcdir (allowed_dirs()) {
+               if (-e "$srcdir/$file") {
+                       $dir = $srcdir;
+                       last;
+               }
+       }
+
+       if (! defined $dir) {

                error(sprintf(gettext("%s is not in the srcdir, so it cannot be deleted"), $file));
        }
                error(sprintf(gettext("%s is not in the srcdir, so it cannot be deleted"), $file));
        }

-       elsif (-l "$config{srcdir}/$file" && ! -f _) {
+       elsif (-l "$dir/$file" && ! -f _) {

                error(sprintf(gettext("%s is not a file"), $file));
        }
        
                error(sprintf(gettext("%s is not a file"), $file));
        }
        


@@ -46,7 +64,7 @@ sub check_canremove ($$$) {
        # This is sorta overkill, but better safe than sorry.
        if (! defined pagetype($pagesources{$page})) {
                if (IkiWiki::Plugin::attachment->can("check_canattach")) {
        # This is sorta overkill, but better safe than sorry.
        if (! defined pagetype($pagesources{$page})) {
                if (IkiWiki::Plugin::attachment->can("check_canattach")) {

-                       IkiWiki::Plugin::attachment::check_canattach($session, $page, "$config{srcdir}/$file");
+                       IkiWiki::Plugin::attachment::check_canattach($session, $page, "$dir/$file");

                }
                else {
                        error("removal of attachments is not allowed");
                }
                else {
                        error("removal of attachments is not allowed");


@@ -124,7 +142,7 @@ sub removal_confirm ($$@) {
                        my $f=IkiWiki::Plugin::attachment::is_held_attachment($page);
                        if (defined $f) {
                                require IkiWiki::Render;
                        my $f=IkiWiki::Plugin::attachment::is_held_attachment($page);
                        if (defined $f) {
                                require IkiWiki::Render;

-                               IkiWiki::prune($f);
+                               IkiWiki::prune($f, "$config{wikistatedir}/attachments");

                        }
                }
        }
                        }
                }
        }


@@ -202,7 +220,7 @@ sub sessioncgi ($$) {
                        postremove($session);
                }
                elsif ($form->submitted eq 'Remove' && $form->validate) {
                        postremove($session);
                }
                elsif ($form->submitted eq 'Remove' && $form->validate) {

-                       IkiWiki::checksessionexpiry($q, $session, $q->param('sid'));
+                       IkiWiki::checksessionexpiry($q, $session);

 
                        my @pages=$form->field("page");
                        
 
                        my @pages=$form->field("page");
                        


@@ -223,21 +241,34 @@ sub sessioncgi ($$) {
                        require IkiWiki::Render;
                        if ($config{rcs}) {
                                IkiWiki::disable_commit_hook();
                        require IkiWiki::Render;
                        if ($config{rcs}) {
                                IkiWiki::disable_commit_hook();

-                               foreach my $file (@files) {
-                                       IkiWiki::rcs_remove($file);
+                       }
+                       my $rcs_removed = 1;
+
+                       foreach my $file (@files) {
+                               foreach my $srcdir (allowed_dirs()) {
+                                       if (-e "$srcdir/$file") {
+                                               if ($srcdir eq $config{srcdir} && $config{rcs}) {
+                                                       IkiWiki::rcs_remove($file);
+                                                       $rcs_removed = 1;
+                                               }
+                                               else {
+                                                       IkiWiki::prune("$srcdir/$file", $srcdir);
+                                               }
+                                       }

                                }
                                }

-                               IkiWiki::rcs_commit_staged(
-                                       message => gettext("removed"),
-                                       session => $session,
-                               );
-                               IkiWiki::enable_commit_hook();
-                               IkiWiki::rcs_update();

                        }
                        }

-                       else {
-                               foreach my $file (@files) {
-                                       IkiWiki::prune("$config{srcdir}/$file");
+
+                       if ($config{rcs}) {
+                               if ($rcs_removed) {
+                                       IkiWiki::rcs_commit_staged(
+                                               message => gettext("removed"),
+                                               session => $session,
+                                       );

                                }
                                }

+                               IkiWiki::enable_commit_hook();
+                               IkiWiki::rcs_update();

                        }
                        }

+

                        IkiWiki::refresh();
                        IkiWiki::saveindex();
 
                        IkiWiki::refresh();
                        IkiWiki::saveindex();