ikiwiki-mass-rebuild: Fix tty hijacking vulnerability by using su. (Once su's related...

[git.ikiwiki.info.git] / IkiWiki.pm

diff --git a/IkiWiki.pm b/IkiWiki.pm
index 98145a585efda00b7110db7762b3be7106c169c9..443c7044796a29947936fd5de57e8e09c14bfec4 100644 (file)
--- a/IkiWiki.pm
+++ b/IkiWiki.pm
@@ -88,6 +88,7 @@ sub defaultconfig () { #{{{
        account_creation_password => "",
        prefix_directives => 0,
        hardlink => 0,
+       cgi_disable_uploads => 1,
 } #}}}
 
 sub checkconfig () { #{{{
@@ -103,6 +104,12 @@ sub checkconfig () { #{{{
                }
        }
 
+       if (ref $config{ENV} eq 'HASH') {
+               foreach my $val (keys %{$config{ENV}}) {
+                       $ENV{$val}=$config{ENV}{$val};
+               }
+       }
+
        if ($config{w3mmode}) {
                eval q{use Cwd q{abs_path}};
                error($@) if $@;
@@ -144,7 +151,9 @@ sub loadplugins () { #{{{
                unshift @INC, possibly_foolish_untaint($config{libdir});
        }
 
-       loadplugin($_) foreach @{$config{plugin}};
+       foreach my $plugin (@{$config{plugin}}) {
+               loadplugin($plugin);
+       }
 
        run_hooks(getopt => sub { shift->() });
        if (grep /^-/, @ARGV) {
@@ -282,18 +291,22 @@ sub htmlpage ($) { #{{{
        return targetpage($page, $config{htmlext});
 } #}}}
 
-sub srcfile ($;$) { #{{{
+sub srcfile_stat { #{{{
        my $file=shift;
        my $nothrow=shift;
 
-       return "$config{srcdir}/$file" if -e "$config{srcdir}/$file";
+       return "$config{srcdir}/$file", stat(_) if -e "$config{srcdir}/$file";
        foreach my $dir (@{$config{underlaydirs}}, $config{underlaydir}) {
-               return "$dir/$file" if -e "$dir/$file";
+               return "$dir/$file", stat(_) if -e "$dir/$file";
        }
        error("internal error: $file cannot be found in $config{srcdir} or underlay") unless $nothrow;
        return;
 } #}}}
 
+sub srcfile ($;$) { #{{{
+       return (srcfile_stat(@_))[0];
+} #}}}
+
 sub add_underlay ($) { #{{{
        my $dir=shift;
 
@@ -321,6 +334,10 @@ sub readfile ($;$$) { #{{{
        binmode($in) if ($binary);
        return \*$in if $wantfd;
        my $ret=<$in>;
+       # check for invalid utf-8, and toss it back to avoid crashes
+       if (! utf8::valid($ret)) {
+               $ret=encode_utf8($ret);
+       }
        close $in || error("failed to read $file: $!");
        return $ret;
 } #}}}
@@ -527,23 +544,33 @@ sub beautify_url ($) { #{{{
        if ($config{usedirs}) {
                $url =~ s!/index.$config{htmlext}$!/!;
        }
-       $url =~ s!^$!./!; # Browsers don't like empty links...
+
+       # Ensure url is not an empty link, and
+       # if it's relative, make that explicit to avoid colon confusion.
+       if ($url !~ /^\//) {
+               $url="./$url";
+       }
 
        return $url;
 } #}}}
 
-sub urlto ($$) { #{{{
+sub urlto ($$;$) { #{{{
        my $to=shift;
        my $from=shift;
-
+       my $absolute=shift;
+       
        if (! length $to) {
-               return beautify_url(baseurl($from));
+               return beautify_url(baseurl($from)."index.$config{htmlext}");
        }
 
        if (! $destsources{$to}) {
                $to=htmlpage($to);
        }
 
+       if ($absolute) {
+               return $config{url}.beautify_url("/".$to);
+       }
+
        my $link = abs2rel($to, dirname(htmlpage($from)));
 
        return beautify_url($link);
@@ -585,10 +612,10 @@ sub htmllink ($$$;@) { #{{{
                        return "<span class=\"createlink\"><a href=\"".
                                cgiurl(
                                        do => "create",
-                                       page => pagetitle(lc($link), 1),
+                                       page => lc($link),
                                        from => $lpage
                                ).
-                               "\">?</a>$linktext</span>"
+                               "\" rel=\"nofollow\">?</a>$linktext</span>"
                }
        }
        
@@ -631,8 +658,9 @@ sub userlink ($) { #{{{
        }
 } #}}}
 
-sub htmlize ($$$) { #{{{
+sub htmlize ($$$$) { #{{{
        my $page=shift;
+       my $destpage=shift;
        my $type=shift;
        my $content=shift;
        
@@ -651,6 +679,7 @@ sub htmlize ($$$) { #{{{
        run_hooks(sanitize => sub {
                $content=shift->(
                        page => $page,
+                       destpage => $destpage,
                        content => $content,
                );
        });
@@ -682,7 +711,7 @@ sub linkify ($$$) { #{{{
        return $content;
 } #}}}
 
-my %preprocessing;
+our %preprocessing;
 our $preprocess_preview=0;
 sub preprocess ($$$;$$) { #{{{
        my $page=shift; # the page the data comes from
@@ -700,6 +729,8 @@ sub preprocess ($$$;$$) { #{{{
                my $prefix=shift;
                my $command=shift;
                my $params=shift;
+               $params="" if ! defined $params;
+
                if (length $escape) {
                        return "[[$prefix$command $params]]";
                }
@@ -1252,6 +1283,7 @@ sub pagespec_translate ($) { #{{{
                $code=0;
        }
 
+       no warnings;
        return eval 'sub { my $page=shift; '.$code.' }';
 } #}}}
 
@@ -1266,7 +1298,7 @@ sub pagespec_match ($$;@) { #{{{
        }
 
        my $sub=pagespec_translate($spec);
-       return IkiWiki::FailReason->new('syntax error') if $@;
+       return IkiWiki::FailReason->new("syntax error in pagespec \"$spec\"") if $@;
        return $sub->($page, @params);
 } #}}}
 
@@ -1276,6 +1308,13 @@ sub pagespec_valid ($) { #{{{
        my $sub=pagespec_translate($spec);
        return ! $@;
 } #}}}
+       
+sub glob2re ($) { #{{{
+       my $re=quotemeta(shift);
+       $re=~s/\\\*/.*/g;
+       $re=~s/\\\?/./g;
+       return $re;
+} #}}}
 
 package IkiWiki::FailReason;
 
@@ -1323,12 +1362,8 @@ sub match_glob ($$;@) { #{{{
                $glob="$from/$glob" if length $from;
        }
 
-       # turn glob into safe regexp
-       $glob=quotemeta($glob);
-       $glob=~s/\\\*/.*/g;
-       $glob=~s/\\\?/./g;
-
-       if ($page=~/^$glob$/i) {
+       my $regexp=IkiWiki::glob2re($glob);
+       if ($page=~/^$regexp$/i) {
                if (! IkiWiki::isinternal($page) || $params{internal}) {
                        return IkiWiki::SuccessReason->new("$glob matches $page");
                }