cherry-pick uri security fix

[git.ikiwiki.info.git] / IkiWiki / Plugin / inline.pm

diff --git a/IkiWiki/Plugin/inline.pm b/IkiWiki/Plugin/inline.pm
index 08e1f2769b8b7ca3b526e04808cd171d7ba3a2b4..b4030307847fd0392a848da51330ff40db15889b 100644 (file)
--- a/IkiWiki/Plugin/inline.pm
+++ b/IkiWiki/Plugin/inline.pm
@@ -4,12 +4,17 @@ package IkiWiki::Plugin::inline;
 
 use warnings;
 use strict;
 
 use warnings;
 use strict;

+use Encode;

 use IkiWiki 2.00;
 use URI;
 
 use IkiWiki 2.00;
 use URI;
 

+my %knownfeeds;
+my %page_numfeeds;
+

 sub import { #{{{
        hook(type => "getopt", id => "inline", call => \&getopt);
        hook(type => "checkconfig", id => "inline", call => \&checkconfig);
 sub import { #{{{
        hook(type => "getopt", id => "inline", call => \&getopt);
        hook(type => "checkconfig", id => "inline", call => \&checkconfig);

+       hook(type => "sessioncgi", id => "inline", call => \&sessioncgi);

        hook(type => "preprocess", id => "inline", 
                call => \&IkiWiki::preprocess_inline);
        hook(type => "pagetemplate", id => "inline",
        hook(type => "preprocess", id => "inline", 
                call => \&IkiWiki::preprocess_inline);
        hook(type => "pagetemplate", id => "inline",


@@ -19,6 +24,7 @@ sub import { #{{{
        # pings interrupting page builds.
        hook(type => "change", id => "inline", 
                call => \&IkiWiki::pingurl);
        # pings interrupting page builds.
        hook(type => "change", id => "inline", 
                call => \&IkiWiki::pingurl);

+

 } # }}}
 
 sub getopt () { #{{{
 } # }}}
 
 sub getopt () { #{{{


@@ -28,6 +34,8 @@ sub getopt () { #{{{
        GetOptions(
                "rss!" => \$config{rss},
                "atom!" => \$config{atom},
        GetOptions(
                "rss!" => \$config{rss},
                "atom!" => \$config{atom},

+               "allowrss!" => \$config{allowrss},
+               "allowatom!" => \$config{allowatom},

        );
 }
 
        );
 }
 


@@ -43,6 +51,28 @@ sub checkconfig () { #{{{
        }
 } #}}}
 
        }
 } #}}}
 

+sub sessioncgi () { #{{{
+       my $q=shift;
+       my $session=shift;
+
+       if ($q->param('do') eq 'blog') {
+               my $page=decode_utf8($q->param('title'));
+               $page=~s/\///g; # no slashes in blog posts
+               # if the page already exists, munge it to be unique
+               my $from=$q->param('from');
+               my $add="";
+               while (exists $IkiWiki::pagecase{lc($from."/".IkiWiki::titlepage($page).$add)}) {
+                       $add=1 unless length $add;
+                       $add++;
+               }
+               $q->param('page', $page.$add);
+               # now go create the page
+               $q->param('do', 'create');
+               IkiWiki::cgi_editpage($q, $session);
+               exit;
+       }
+}
+

 # Back to ikiwiki namespace for the rest, this code is very much
 # internal to ikiwiki even though it's separated into a plugin.
 package IkiWiki;
 # Back to ikiwiki namespace for the rest, this code is very much
 # internal to ikiwiki even though it's separated into a plugin.
 package IkiWiki;


@@ -63,11 +93,11 @@ sub preprocess_inline (@) { #{{{
        }
        my $raw=yesno($params{raw});
        my $archive=yesno($params{archive});
        }
        my $raw=yesno($params{raw});
        my $archive=yesno($params{archive});

-       my $rss=($config{rss} && exists $params{rss}) ? yesno($params{rss}) : $config{rss};
-       my $atom=($config{atom} && exists $params{atom}) ? yesno($params{atom}) : $config{atom};
+       my $rss=(($config{rss} || $config{allowrss}) && exists $params{rss}) ? yesno($params{rss}) : $config{rss};
+       my $atom=(($config{atom} || $config{allowatom}) && exists $params{atom}) ? yesno($params{atom}) : $config{atom};

        my $quick=exists $params{quick} ? yesno($params{quick}) : 0;
        my $feeds=exists $params{feeds} ? yesno($params{feeds}) : !$quick;
        my $quick=exists $params{quick} ? yesno($params{quick}) : 0;
        my $feeds=exists $params{feeds} ? yesno($params{feeds}) : !$quick;

-       $feeds=0 if $params{preview};
+       my $feedonly=yesno($params{feedonly});

        if (! exists $params{show} && ! $archive) {
                $params{show}=10;
        }
        if (! exists $params{show} && ! $archive) {
                $params{show}=10;
        }


@@ -123,12 +153,37 @@ sub preprocess_inline (@) { #{{{
        # that if they are removed or otherwise changed, the inline will be
        # sure to be updated.
        add_depends($params{page}, join(" or ", @list));
        # that if they are removed or otherwise changed, the inline will be
        # sure to be updated.
        add_depends($params{page}, join(" or ", @list));

+       # Force a scan of this page so any metadata that appears after this
+       # inline directive is available when inlining. The page normally 
+       # wouldn't be scanned if it's only being rebuilt because of a
+       # depedency.
+       IkiWiki::scan($pagesources{$params{page}});
+
+       my $feednum="";

 
 

-       my $rssurl=basename(rsspage($params{page}));
-       my $atomurl=basename(atompage($params{page}));
+       my $feedid=join("\0", map { $_."\0".$params{$_} } sort keys %params);
+       if (exists $knownfeeds{$feedid}) {
+               $feednum=$knownfeeds{$feedid};
+       }
+       else {
+               if (exists $page_numfeeds{$params{destpage}}) {
+                       if ($feeds) {
+                               $feednum=$knownfeeds{$feedid}=++$page_numfeeds{$params{destpage}};
+                       }
+               }
+               else {
+                       $feednum=$knownfeeds{$feedid}="";
+                       if ($feeds) {
+                               $page_numfeeds{$params{destpage}}=1;
+                       }
+               }
+       }
+
+       my $rssurl=basename(rsspage($params{destpage}).$feednum) if $feeds && $rss;
+       my $atomurl=basename(atompage($params{destpage}).$feednum) if $feeds && $atom;

        my $ret="";
 
        my $ret="";
 

-       if ($config{cgiurl} && (exists $params{rootpage} ||
+       if ($config{cgiurl} && ! $params{preview} && (exists $params{rootpage} ||

                        (exists $params{postform} && yesno($params{postform})))) {
                # Add a blog post form, with feed buttons.
                my $formtemplate=template("blogpost.tmpl", blind_cache => 1);
                        (exists $params{postform} && yesno($params{postform})))) {
                # Add a blog post form, with feed buttons.
                my $formtemplate=template("blogpost.tmpl", blind_cache => 1);


@@ -147,7 +202,7 @@ sub preprocess_inline (@) { #{{{
                }
                $ret.=$formtemplate->output;
        }
                }
                $ret.=$formtemplate->output;
        }

-       elsif ($feeds) {
+       elsif ($feeds && !$params{preview}) {

                # Add feed buttons.
                my $linktemplate=template("feedlink.tmpl", blind_cache => 1);
                $linktemplate->param(rssurl => $rssurl) if $rss;
                # Add feed buttons.
                my $linktemplate=template("feedlink.tmpl", blind_cache => 1);
                $linktemplate->param(rssurl => $rssurl) if $rss;


@@ -155,66 +210,70 @@ sub preprocess_inline (@) { #{{{
                $ret.=$linktemplate->output;
        }
        
                $ret.=$linktemplate->output;
        }
        

-       require HTML::Template;
-       my @params=IkiWiki::template_params($params{template}.".tmpl", blind_cache => 1);
-       if (! @params) {
-               return sprintf(gettext("nonexistant template %s"), $params{template});
-       }
-       my $template=HTML::Template->new(@params) unless $raw;
+       if (! $feedonly) {
+               require HTML::Template;
+               my @params=IkiWiki::template_params($params{template}.".tmpl", blind_cache => 1);
+               if (! @params) {
+                       return sprintf(gettext("nonexistant template %s"), $params{template});
+               }
+               my $template=HTML::Template->new(@params) unless $raw;

        
        

-       foreach my $page (@list) {
-               my $file = $pagesources{$page};
-               my $type = pagetype($file);
-               if (! $raw || ($raw && ! defined $type)) {
-                       unless ($archive && $quick) {
-                               # Get the content before populating the
-                               # template, since getting the content uses
-                               # the same template if inlines are nested.
-                               my $content=get_inline_content($page, $params{destpage});
-                               $template->param(content => $content);
-                       }
-                       $template->param(pageurl => urlto(bestlink($params{page}, $page), $params{destpage}));
-                       $template->param(title => pagetitle(basename($page)));
-                       $template->param(ctime => displaytime($pagectime{$page}));
-
-                       if ($actions) {
-                               my $file = $pagesources{$page};
-                               my $type = pagetype($file);
-                               if ($config{discussion}) {
-                                       my $discussionlink=gettext("discussion");
-                                       if ($page !~ /.*\/\Q$discussionlink\E$/ &&
-                                           (length $config{cgiurl} ||
-                                            exists $links{$page."/".$discussionlink})) {
+               foreach my $page (@list) {
+                       my $file = $pagesources{$page};
+                       my $type = pagetype($file);
+                       if (! $raw || ($raw && ! defined $type)) {
+                               unless ($archive && $quick) {
+                                       # Get the content before populating the
+                                       # template, since getting the content uses
+                                       # the same template if inlines are nested.
+                                       my $content=get_inline_content($page, $params{destpage});
+                                       $template->param(content => $content);
+                               }
+                               $template->param(pageurl => urlto(bestlink($params{page}, $page), $params{destpage}));
+                               $template->param(title => pagetitle(basename($page)));
+                               $template->param(ctime => displaytime($pagectime{$page}, $params{timeformat}));
+                               $template->param(first => 1) if $page eq $list[0];
+                               $template->param(last => 1) if $page eq $list[$#list];
+       
+                               if ($actions) {
+                                       my $file = $pagesources{$page};
+                                       my $type = pagetype($file);
+                                       if ($config{discussion}) {
+                                               my $discussionlink=gettext("discussion");
+                                               if ($page !~ /.*\/\Q$discussionlink\E$/ &&
+                                                   (length $config{cgiurl} ||
+                                                    exists $links{$page."/".$discussionlink})) {
+                                                       $template->param(have_actions => 1);
+                                                       $template->param(discussionlink =>
+                                                               htmllink($page,
+                                                                       $params{destpage},
+                                                                       gettext("Discussion"),
+                                                                       noimageinline => 1,
+                                                                       forcesubpage => 1));
+                                               }
+                                       }
+                                       if (length $config{cgiurl} && defined $type) {

                                                $template->param(have_actions => 1);
                                                $template->param(have_actions => 1);

-                                               $template->param(discussionlink =>
-                                                       htmllink($page,
-                                                               $params{page},
-                                                               gettext("Discussion"),
-                                                               noimageinline => 1,
-                                                               forcesubpage => 1));
+                                               $template->param(editurl => cgiurl(do => "edit", page => pagetitle($page, 1)));

                                        }
                                }
                                        }
                                }

-                               if (length $config{cgiurl} && defined $type) {
-                                       $template->param(have_actions => 1);
-                                       $template->param(editurl => cgiurl(do => "edit", page => pagetitle($page, 1)));
-                               }
+       
+                               run_hooks(pagetemplate => sub {
+                                       shift->(page => $page, destpage => $params{destpage},
+                                               template => $template,);
+                               });
+       
+                               $ret.=$template->output;
+                               $template->clear_params;

                        }
                        }

-
-                       run_hooks(pagetemplate => sub {
-                               shift->(page => $page, destpage => $params{page},
-                                       template => $template,);
-                       });
-
-                       $ret.=$template->output;
-                       $template->clear_params;
-               }
-               else {
-                       if (defined $type) {
-                               $ret.="\n".
-                                     linkify($page, $params{page},
-                                     preprocess($page, $params{page},
-                                     filter($page, $params{page},
-                                     readfile(srcfile($file)))));
+                       else {
+                               if (defined $type) {
+                                       $ret.="\n".
+                                             linkify($page, $params{destpage},
+                                             preprocess($page, $params{destpage},
+                                             filter($page, $params{destpage},
+                                             readfile(srcfile($file)))));
+                               }

                        }
                }
        }
                        }
                }
        }


@@ -228,20 +287,24 @@ sub preprocess_inline (@) { #{{{
                }
        
                if ($rss) {
                }
        
                if ($rss) {

-                       my $rssp=rsspage($params{page});
-                       will_render($params{page}, $rssp);
-                       writefile($rssp, $config{destdir},
-                               genfeed("rss", $rssurl, $desc, $params{page}, @list));
-                       $toping{$params{page}}=1 unless $config{rebuild};
-                       $feedlinks{$params{destpage}}=qq{<link rel="alternate" type="application/rss+xml" title="RSS" href="$rssurl" />};
+                       my $rssp=rsspage($params{destpage}).$feednum;
+                       will_render($params{destpage}, $rssp);
+                       if (! $params{preview}) {
+                               writefile($rssp, $config{destdir},
+                                       genfeed("rss", $rssurl, $desc, $params{destpage}, @list));
+                               $toping{$params{destpage}}=1 unless $config{rebuild};
+                               $feedlinks{$params{destpage}}=qq{<link rel="alternate" type="application/rss+xml" title="RSS" href="$rssurl" />};
+                       }

                }
                if ($atom) {
                }
                if ($atom) {

-                       my $atomp=atompage($params{page});
-                       will_render($params{page}, $atomp);
-                       writefile($atomp, $config{destdir},
-                               genfeed("atom", $atomurl, $desc, $params{page}, @list));
-                       $toping{$params{page}}=1 unless $config{rebuild};
-                       $feedlinks{$params{destpage}}=qq{<link rel="alternate" type="application/atom+xml" title="Atom" href="$atomurl" />};
+                       my $atomp=atompage($params{destpage}).$feednum;
+                       will_render($params{destpage}, $atomp);
+                       if (! $params{preview}) {
+                               writefile($atomp, $config{destdir},
+                                       genfeed("atom", $atomurl, $desc, $params{destpage}, @list));
+                               $toping{$params{destpage}}=1 unless $config{rebuild};
+                               $feedlinks{$params{destpage}}=qq{<link rel="alternate" type="application/atom+xml" title="Atom" href="$atomurl" />};
+                       }

                }
        }
        
                }
        }
        


@@ -290,7 +353,7 @@ sub date_3339 ($) { #{{{
 
        my $lc_time=POSIX::setlocale(&POSIX::LC_TIME);
        POSIX::setlocale(&POSIX::LC_TIME, "C");
 
        my $lc_time=POSIX::setlocale(&POSIX::LC_TIME);
        POSIX::setlocale(&POSIX::LC_TIME, "C");

-       my $ret=POSIX::strftime("%Y-%m-%dT%H:%M:%SZ", localtime($time));
+       my $ret=POSIX::strftime("%Y-%m-%dT%H:%M:%SZ", gmtime($time));

        POSIX::setlocale(&POSIX::LC_TIME, $lc_time);
        return $ret;
 } #}}}
        POSIX::setlocale(&POSIX::LC_TIME, $lc_time);
        return $ret;
 } #}}}


@@ -337,8 +400,10 @@ sub genfeed ($$$$@) { #{{{
                        title => pagetitle(basename($p)),
                        url => $u,
                        permalink => $u,
                        title => pagetitle(basename($p)),
                        url => $u,
                        permalink => $u,

-                       date_822 => date_822($pagectime{$p}),
-                       date_3339 => date_3339($pagectime{$p}),
+                       cdate_822 => date_822($pagectime{$p}),
+                       mdate_822 => date_822($pagemtime{$p}),
+                       cdate_3339 => date_3339($pagectime{$p}),
+                       mdate_3339 => date_3339($pagemtime{$p}),

                );
 
                if ($itemtemplate->query(name => "enclosure")) {
                );
 
                if ($itemtemplate->query(name => "enclosure")) {


@@ -373,7 +438,7 @@ sub genfeed ($$$$@) { #{{{
                $content.=$itemtemplate->output;
                $itemtemplate->clear_params;
 
                $content.=$itemtemplate->output;
                $itemtemplate->clear_params;
 

-               $lasttime = $pagectime{$p} if $pagectime{$p} > $lasttime;
+               $lasttime = $pagemtime{$p} if $pagemtime{$p} > $lasttime;

        }
 
        my $template=template($feedtype."page.tmpl", blind_cache => 1);
        }
 
        my $template=template($feedtype."page.tmpl", blind_cache => 1);