meta: Security fix; don't allow alternative stylesheets to be added on pages where...

[git.ikiwiki.info.git] / IkiWiki / Plugin / attachment.pm

diff --git a/IkiWiki/Plugin/attachment.pm b/IkiWiki/Plugin/attachment.pm
index 953e71625a24345cb323408ab43287a427828b4d..647a671a518b9b9c4cdafbffc7675da661c8a0b6 100644 (file)
--- a/IkiWiki/Plugin/attachment.pm
+++ b/IkiWiki/Plugin/attachment.pm
@@ -19,6 +19,7 @@ sub getsetup () {
                plugin => {
                        safe => 1,
                        rebuild => 0,
                plugin => {
                        safe => 1,
                        rebuild => 0,

+                       section => "web",

                },
                allowed_attachments => {
                        type => "pagespec",
                },
                allowed_attachments => {
                        type => "pagespec",


@@ -57,7 +58,7 @@ sub check_canattach ($$;$) {
                        $config{allowed_attachments},
                        file => $file,
                        user => $session->param("name"),
                        $config{allowed_attachments},
                        file => $file,
                        user => $session->param("name"),

-                       ip => $ENV{REMOTE_ADDR},
+                       ip => $session->remote_addr(),

                );
        }
 
                );
        }
 


@@ -91,7 +92,7 @@ sub formbuilder_setup (@) {
                # Add the toggle javascript; the attachments interface uses
                # it to toggle visibility.
                require IkiWiki::Plugin::toggle;
                # Add the toggle javascript; the attachments interface uses
                # it to toggle visibility.
                require IkiWiki::Plugin::toggle;

-               $form->tmpl_param("javascript" => IkiWiki::Plugin::toggle::include_javascript($params{page}, 1));
+               $form->tmpl_param("javascript" => IkiWiki::Plugin::toggle::include_javascript($params{page}));

                # Start with the attachments interface toggled invisible,
                # but if it was used, keep it open.
                if ($form->submitted ne "Upload Attachment" &&
                # Start with the attachments interface toggled invisible,
                # but if it was used, keep it open.
                if ($form->submitted ne "Upload Attachment" &&


@@ -133,16 +134,19 @@ sub formbuilder (@) {
                        }
                }
 
                        }
                }
 

+               $filename=IkiWiki::basename($filename);
+               $filename=~s/.*\\+(.+)/$1/; # hello, windows
+

                $filename=linkpage(IkiWiki::possibly_foolish_untaint(
                                attachment_location($form->field('page')).
                $filename=linkpage(IkiWiki::possibly_foolish_untaint(
                                attachment_location($form->field('page')).

-                               IkiWiki::basename($filename)));
-               if (IkiWiki::file_pruned($filename, $config{srcdir})) {
+                               $filename));
+               if (IkiWiki::file_pruned($filename)) {

                        error(gettext("bad attachment filename"));
                }
                
                # Check that the user is allowed to edit a page with the
                # name of the attachment.
                        error(gettext("bad attachment filename"));
                }
                
                # Check that the user is allowed to edit a page with the
                # name of the attachment.

-               IkiWiki::check_canedit($filename, $q, $session, 1);
+               IkiWiki::check_canedit($filename, $q, $session);

                # And that the attachment itself is acceptable.
                check_canattach($session, $filename, $tempfile);
 
                # And that the attachment itself is acceptable.
                check_canattach($session, $filename, $tempfile);
 


@@ -179,9 +183,12 @@ sub formbuilder (@) {
                if ($config{rcs}) {
                        IkiWiki::rcs_add($filename);
                        IkiWiki::disable_commit_hook();
                if ($config{rcs}) {
                        IkiWiki::rcs_add($filename);
                        IkiWiki::disable_commit_hook();

-                       IkiWiki::rcs_commit($filename, gettext("attachment upload"),
-                               IkiWiki::rcs_prepedit($filename),
-                               $session->param("name"), $ENV{REMOTE_ADDR});
+                       IkiWiki::rcs_commit(
+                               file => $filename,
+                               message => gettext("attachment upload"),
+                               token => IkiWiki::rcs_prepedit($filename),
+                               session => $session,
+                       );

                        IkiWiki::enable_commit_hook();
                        IkiWiki::rcs_update();
                }
                        IkiWiki::enable_commit_hook();
                        IkiWiki::rcs_update();
                }


@@ -194,7 +201,14 @@ sub formbuilder (@) {
                foreach my $f ($q->param("attachment_select")) {
                        $f=Encode::decode_utf8($f);
                        $f=~s/^$page\///;
                foreach my $f ($q->param("attachment_select")) {
                        $f=Encode::decode_utf8($f);
                        $f=~s/^$page\///;

-                       $add.="[[$f]]\n";
+                       if (IkiWiki::isinlinableimage($f) &&
+                           UNIVERSAL::can("IkiWiki::Plugin::img", "import")) {
+                               $add.='[[!img '.$f.' align="right" size="" alt=""]]';
+                       }
+                       else {
+                               $add.="[[$f]]";
+                       }
+                       $add.="\n";

                }
                $form->field(name => 'editcontent',
                        value => $form->field('editcontent')."\n\n".$add,
                }
                $form->field(name => 'editcontent',
                        value => $form->field('editcontent')."\n\n".$add,


@@ -224,13 +238,13 @@ sub attachment_list ($) {
        my @ret;
        foreach my $f (values %pagesources) {
                if (! defined pagetype($f) &&
        my @ret;
        foreach my $f (values %pagesources) {
                if (! defined pagetype($f) &&

-                   $f=~m/^\Q$loc\E[^\/]+$/ &&
-                   -e "$config{srcdir}/$f") {
+                   $f=~m/^\Q$loc\E[^\/]+$/) {

                        push @ret, {
                                "field-select" => '<input type="checkbox" name="attachment_select" value="'.$f.'" />',
                                link => htmllink($page, $page, $f, noimageinline => 1),
                        push @ret, {
                                "field-select" => '<input type="checkbox" name="attachment_select" value="'.$f.'" />',
                                link => htmllink($page, $page, $f, noimageinline => 1),

-                               size => IkiWiki::Plugin::filecheck::humansize((stat(_))[7]),
+                               size => IkiWiki::Plugin::filecheck::humansize((stat($f))[7]),

                                mtime => displaytime($IkiWiki::pagemtime{$f}),
                                mtime => displaytime($IkiWiki::pagemtime{$f}),

+                               mtime_raw => $IkiWiki::pagemtime{$f},

                        };
                }
        }
                        };
                }
        }