passwordauth: avoid userinfo forgery via repeated email parameter

[git.ikiwiki.info.git] / IkiWiki / Plugin / filecheck.pm

diff --git a/IkiWiki/Plugin/filecheck.pm b/IkiWiki/Plugin/filecheck.pm
index 0501ba99cb3e0a13c4b8a73204ee28bfeb785849..9992f2c2699371eb39ddb86776bba6c18c7a3562 100644 (file)
--- a/IkiWiki/Plugin/filecheck.pm
+++ b/IkiWiki/Plugin/filecheck.pm
@@ -39,6 +39,18 @@ my %units=(          # size in bytes
        #   -- Joey
 );
 
        #   -- Joey
 );
 

+sub import {
+       hook(type => "getsetup", id => "filecheck",  call => \&getsetup);
+}
+
+sub getsetup () {
+       return
+               plugin => {
+                       safe => 1,
+                       rebuild => undef,
+               },
+}
+

 sub parsesize ($) {
        my $size=shift;
 
 sub parsesize ($) {
        my $size=shift;
 


@@ -75,9 +87,9 @@ sub match_maxsize ($$;@) {
        }
 
        my %params=@_;
        }
 
        my %params=@_;

-       my $file=exists $params{file} ? $params{file} : $IkiWiki::pagesources{$page};
+       my $file=exists $params{file} ? $params{file} : IkiWiki::srcfile($IkiWiki::pagesources{$page});

        if (! defined $file) {
        if (! defined $file) {

-               return IkiWiki::ErrorReason->new("no file specified");
+               return IkiWiki::ErrorReason->new("file does not exist");

        }
 
        if (-s $file > $maxsize) {
        }
 
        if (-s $file > $maxsize) {


@@ -96,9 +108,9 @@ sub match_minsize ($$;@) {
        }
 
        my %params=@_;
        }
 
        my %params=@_;

-       my $file=exists $params{file} ? $params{file} : $IkiWiki::pagesources{$page};
+       my $file=exists $params{file} ? $params{file} : IkiWiki::srcfile($IkiWiki::pagesources{$page});

        if (! defined $file) {
        if (! defined $file) {

-               return IkiWiki::ErrorReason->new("no file specified");
+               return IkiWiki::ErrorReason->new("file does not exist");

        }
 
        if (-s $file < $minsize) {
        }
 
        if (-s $file < $minsize) {


@@ -114,27 +126,41 @@ sub match_mimetype ($$;@) {
        my $wanted=shift;
 
        my %params=@_;
        my $wanted=shift;
 
        my %params=@_;

-       my $file=exists $params{file} ? $params{file} : $IkiWiki::pagesources{$page};
+       my $file=exists $params{file} ? $params{file} : IkiWiki::srcfile($IkiWiki::pagesources{$page});

        if (! defined $file) {
        if (! defined $file) {

-               return IkiWiki::ErrorReason->new("no file specified");
+               return IkiWiki::ErrorReason->new("file does not exist");

        }
 
        }
 

-       # Use ::magic to get the mime type, the idea is to only trust
-       # data obtained by examining the actual file contents.
+       # Get the mime type.
+       #
+       # First, try File::Mimeinfo. This is fast, but doesn't recognise
+       # all files.

        eval q{use File::MimeInfo::Magic};
        eval q{use File::MimeInfo::Magic};

-       if ($@) {
-               return IkiWiki::ErrorReason->new("failed to load File::MimeInfo::Magic ($@); cannot check MIME type");
+       my $mimeinfo_ok=! $@;
+       my $mimetype;
+       if ($mimeinfo_ok) {
+               my $mimetype=File::MimeInfo::Magic::magic($file);

        }
        }

-       my $mimetype=File::MimeInfo::Magic::magic($file);
+
+       # Fall back to using file, which has a more complete
+       # magic database.

        if (! defined $mimetype) {
        if (! defined $mimetype) {

-               $mimetype=File::MimeInfo::Magic::default($file);
+               open(my $file_h, "-|", "file", "-bi", $file);
+               $mimetype=<$file_h>;
+               chomp $mimetype;
+               close $file_h;
+       }
+       if (! defined $mimetype || $mimetype !~s /;.*//) {
+               # Fall back to default value.
+               $mimetype=File::MimeInfo::Magic::default($file)
+                       if $mimeinfo_ok;

                if (! defined $mimetype) {
                        $mimetype="unknown";
                }
        }
 
        my $regexp=IkiWiki::glob2re($wanted);
                if (! defined $mimetype) {
                        $mimetype="unknown";
                }
        }
 
        my $regexp=IkiWiki::glob2re($wanted);

-       if ($mimetype!~/^$regexp$/i) {
+       if ($mimetype!~$regexp) {

                return IkiWiki::FailReason->new("file MIME type is $mimetype, not $wanted");
        }
        else {
                return IkiWiki::FailReason->new("file MIME type is $mimetype, not $wanted");
        }
        else {


@@ -147,9 +173,9 @@ sub match_virusfree ($$;@) {
        my $wanted=shift;
 
        my %params=@_;
        my $wanted=shift;
 
        my %params=@_;

-       my $file=exists $params{file} ? $params{file} : $IkiWiki::pagesources{$page};
+       my $file=exists $params{file} ? $params{file} : IkiWiki::srcfile($IkiWiki::pagesources{$page});

        if (! defined $file) {
        if (! defined $file) {

-               return IkiWiki::ErrorReason->new("no file specified");
+               return IkiWiki::ErrorReason->new("file does not exist");

        }
 
        if (! exists $IkiWiki::config{virus_checker} ||
        }
 
        if (! exists $IkiWiki::config{virus_checker} ||