improve fix for symlink attacks to check subdirectories for symlinks too

[git.ikiwiki.info.git] / ikiwiki

diff --git a/ikiwiki b/ikiwiki
index 4c815dfa3ca0013a2d59866f48d8b86d72e49295..b1bc9984f2bd9475787808d65f886424c250e7cc 100755 (executable)
--- a/ikiwiki
+++ b/ikiwiki
@@ -8,7 +8,8 @@ use File::Spec;
 use HTML::Template;
 use lib '.'; # For use without installation, removed by Makefile.
 
 use HTML::Template;
 use lib '.'; # For use without installation, removed by Makefile.
 

-use vars qw{%config %links %oldlinks %oldpagemtime %renderedfiles %pagesources};
+use vars qw{%config %links %oldlinks %oldpagemtime %pagectime
+            %renderedfiles %pagesources %inlinepages};

 
 sub usage () { #{{{
        die "usage: ikiwiki [options] source dest\n";
 
 sub usage () { #{{{
        die "usage: ikiwiki [options] source dest\n";


@@ -17,9 +18,10 @@ sub usage () { #{{{
 sub getconfig () { #{{{
        if (! exists $ENV{WRAPPED_OPTIONS}) {
                %config=(
 sub getconfig () { #{{{
        if (! exists $ENV{WRAPPED_OPTIONS}) {
                %config=(

-                       wiki_file_prune_regexp => qr{((^|/).svn/|\.\.|^\.|\/\.|\.html?$)},
-                       wiki_link_regexp => qr/\[\[([^\s\]]+)\]\]/,
-                       wiki_file_regexp => qr/(^[-A-Za-z0-9_.\&;:\/+]+$)/,
+                       wiki_file_prune_regexp => qr{((^|/).svn/|\.\.|^\.|\/\.|\.html?$|\.rss$)},
+                       wiki_link_regexp => qr/\[\[(?:([^\s\]\|]+)\|)?([^\s\]]+)\]\]/,
+                       wiki_processor_regexp => qr/\[\[(\w+)\s+([^\]]+)\]\]/,
+                       wiki_file_regexp => qr/(^[-A-Za-z0-9_.:\/+]+$)/,

                        verbose => 0,
                        wikiname => "wiki",
                        default_pageext => ".mdwn",
                        verbose => 0,
                        wikiname => "wiki",
                        default_pageext => ".mdwn",


@@ -32,11 +34,14 @@ sub getconfig () { #{{{
                        anonok => 0,
                        rss => 0,
                        rebuild => 0,
                        anonok => 0,
                        rss => 0,
                        rebuild => 0,

+                       refresh => 0,
+                       getctime => 0,

                        wrapper => undef,
                        wrappermode => undef,
                        srcdir => undef,
                        destdir => undef,
                        templatedir => "/usr/share/ikiwiki/templates",
                        wrapper => undef,
                        wrappermode => undef,
                        srcdir => undef,
                        destdir => undef,
                        templatedir => "/usr/share/ikiwiki/templates",

+                       underlaydir => "/usr/share/ikiwiki/basewiki",

                        setup => undef,
                        adminuser => undef,
                );
                        setup => undef,
                        adminuser => undef,
                );


@@ -47,6 +52,8 @@ sub getconfig () { #{{{
                        "wikiname=s" => \$config{wikiname},
                        "verbose|v!" => \$config{verbose},
                        "rebuild!" => \$config{rebuild},
                        "wikiname=s" => \$config{wikiname},
                        "verbose|v!" => \$config{verbose},
                        "rebuild!" => \$config{rebuild},

+                       "refresh!" => \$config{refresh},
+                       "getctime" => \$config{getctime},

                        "wrappermode=i" => \$config{wrappermode},
                        "svn!" => \$config{svn},
                        "anonok!" => \$config{anonok},
                        "wrappermode=i" => \$config{wrappermode},
                        "svn!" => \$config{svn},
                        "anonok!" => \$config{anonok},


@@ -65,6 +72,9 @@ sub getconfig () { #{{{
                        "templatedir=s" => sub {
                                $config{templatedir}=possibly_foolish_untaint($_[1])
                        },
                        "templatedir=s" => sub {
                                $config{templatedir}=possibly_foolish_untaint($_[1])
                        },

+                       "underlaydir=s" => sub {
+                               $config{underlaydir}=possibly_foolish_untaint($_[1])
+                       },

                        "wrapper:s" => sub {
                                $config{wrapper}=$_[1] ? $_[1] : "ikiwiki-wrap"
                        },
                        "wrapper:s" => sub {
                                $config{wrapper}=$_[1] ? $_[1] : "ikiwiki-wrap"
                        },


@@ -170,6 +180,14 @@ sub htmlpage ($) { #{{{
        return $page.".html";
 } #}}}
 
        return $page.".html";
 } #}}}
 

+sub srcfile ($) { #{{{
+       my $file=shift;
+
+       return "$config{srcdir}/$file" if -e "$config{srcdir}/$file";
+       return "$config{underlaydir}/$file" if -e "$config{underlaydir}/$file";
+       error("internal error: $file cannot be found");
+} #}}}
+

 sub readfile ($) { #{{{
        my $file=shift;
 
 sub readfile ($) { #{{{
        my $file=shift;
 


@@ -184,15 +202,20 @@ sub readfile ($) { #{{{
        return $ret;
 } #}}}
 
        return $ret;
 } #}}}
 

-sub writefile ($$) { #{{{
-       my $file=shift;
+sub writefile ($$$) { #{{{
+       my $file=shift; # can include subdirs
+       my $destdir=shift; # directory to put file in

        my $content=shift;
        
        my $content=shift;
        

-       if (-l $file) {
-               error("cannot write to a symlink ($file)");
+       my $test=$file;
+       while (length $test) {
+               if (-l "$destdir/$test") {
+                       error("cannot write to a symlink ($test)");
+               }
+               $test=dirname($test);

        }
 
        }
 

-       my $dir=dirname($file);
+       my $dir=dirname("$destdir/$file");

        if (! -d $dir) {
                my $d="";
                foreach my $s (split(m!/+!, $dir)) {
        if (! -d $dir) {
                my $d="";
                foreach my $s (split(m!/+!, $dir)) {


@@ -203,7 +226,7 @@ sub writefile ($$) { #{{{
                }
        }
        
                }
        }
        

-       open (OUT, ">$file") || error("failed to write $file: $!");
+       open (OUT, ">$destdir/$file") || error("failed to write $destdir/$file: $!");

        print OUT $content;
        close OUT;
 } #}}}
        print OUT $content;
        close OUT;
 } #}}}


@@ -236,7 +259,7 @@ sub bestlink ($$) { #{{{
 sub isinlinableimage ($) { #{{{
        my $file=shift;
        
 sub isinlinableimage ($) { #{{{
        my $file=shift;
        

-       $file=~/\.(png|gif|jpg|jpeg)$/;
+       $file=~/\.(png|gif|jpg|jpeg)$/i;

 } #}}}
 
 sub pagetitle ($) { #{{{
 } #}}}
 
 sub pagetitle ($) { #{{{


@@ -246,11 +269,35 @@ sub pagetitle ($) { #{{{
        return $page;
 } #}}}
 
        return $page;
 } #}}}
 

-sub htmllink ($$;$$) { #{{{
+sub titlepage ($) { #{{{
+       my $title=shift;
+       $title=~y/ /_/;
+       $title=~s/([^-A-Za-z0-9_:+\/.])/"__".ord($1)."__"/eg;
+       return $title;
+} #}}}
+
+sub cgiurl (@) { #{{{
+       my %params=@_;
+
+       return $config{cgiurl}."?".join("&", map "$_=$params{$_}", keys %params);
+} #}}}
+
+sub styleurl (;$) { #{{{
+       my $page=shift;
+
+       return "$config{url}/style.css" if ! defined $page;
+       
+       $page=~s/[^\/]+$//;
+       $page=~s/[^\/]+\//..\//g;
+       return $page."style.css";
+} #}}}
+
+sub htmllink ($$;$$$) { #{{{

        my $page=shift;
        my $link=shift;
        my $noimageinline=shift; # don't turn links into inline html images
        my $forcesubpage=shift; # force a link to a subpage
        my $page=shift;
        my $link=shift;
        my $noimageinline=shift; # don't turn links into inline html images
        my $forcesubpage=shift; # force a link to a subpage

+       my $linktext=shift; # set to force the link text to something

 
        my $bestlink;
        if (! $forcesubpage) {
 
        my $bestlink;
        if (! $forcesubpage) {


@@ -260,7 +307,7 @@ sub htmllink ($$;$$) { #{{{
                $bestlink="$page/".lc($link);
        }
 
                $bestlink="$page/".lc($link);
        }
 

-       my $linktext=pagetitle($link);
+       $linktext=pagetitle(basename($link)) unless defined $linktext;

        
        return $linktext if length $bestlink && $page eq $bestlink;
        
        
        return $linktext if length $bestlink && $page eq $bestlink;
        


@@ -272,13 +319,15 @@ sub htmllink ($$;$$) { #{{{
                $bestlink=htmlpage($bestlink);
        }
        if (! grep { $_ eq $bestlink } values %renderedfiles) {
                $bestlink=htmlpage($bestlink);
        }
        if (! grep { $_ eq $bestlink } values %renderedfiles) {

-               return "<a href=\"$config{cgiurl}?do=create&page=$link&from=$page\">?</a>$linktext"
+               return "<span><a href=\"".
+                       cgiurl(do => "create", page => $link, from =>$page).
+                       "\">?</a>$linktext</span>"

        }
        
        $bestlink=File::Spec->abs2rel($bestlink, dirname($page));
        
        if (! $noimageinline && isinlinableimage($bestlink)) {
        }
        
        $bestlink=File::Spec->abs2rel($bestlink, dirname($page));
        
        if (! $noimageinline && isinlinableimage($bestlink)) {

-               return "<img src=\"$bestlink\">";
+               return "<img src=\"$bestlink\" alt=\"$linktext\" />";

        }
        return "<a href=\"$bestlink\">$linktext</a>";
 } #}}}
        }
        return "<a href=\"$bestlink\">$linktext</a>";
 } #}}}


@@ -323,12 +372,19 @@ sub loadindex () { #{{{
                        push @{$items{$item}}, $val;
                }
 
                        push @{$items{$item}}, $val;
                }
 

+               next unless exists $items{src}; # skip bad lines for now
+

                my $page=pagename($items{src}[0]);
                my $page=pagename($items{src}[0]);

-               $pagesources{$page}=$items{src}[0];
-               $oldpagemtime{$page}=$items{mtime}[0];
-               $oldlinks{$page}=[@{$items{link}}];
-               $links{$page}=[@{$items{link}}];
-               $renderedfiles{$page}=$items{dest}[0];
+               if (! $config{rebuild}) {
+                       $pagesources{$page}=$items{src}[0];
+                       $oldpagemtime{$page}=$items{mtime}[0];
+                       $oldlinks{$page}=[@{$items{link}}];
+                       $links{$page}=[@{$items{link}}];
+                       $inlinepages{$page}=join(" ", @{$items{inlinepage}})
+                               if exists $items{inlinepage};
+                       $renderedfiles{$page}=$items{dest}[0];
+               }
+               $pagectime{$page}=$items{ctime}[0];

        }
        close IN;
 } #}}}
        }
        close IN;
 } #}}}


@@ -340,11 +396,14 @@ sub saveindex () { #{{{
        open (OUT, ">$config{wikistatedir}/index") || 
                error("cannot write to $config{wikistatedir}/index: $!");
        foreach my $page (keys %oldpagemtime) {
        open (OUT, ">$config{wikistatedir}/index") || 
                error("cannot write to $config{wikistatedir}/index: $!");
        foreach my $page (keys %oldpagemtime) {

+               next unless $oldpagemtime{$page};

                my $line="mtime=$oldpagemtime{$page} ".
                my $line="mtime=$oldpagemtime{$page} ".

+                       "ctime=$pagectime{$page} ".

                        "src=$pagesources{$page} ".
                        "dest=$renderedfiles{$page}";
                        "src=$pagesources{$page} ".
                        "dest=$renderedfiles{$page}";

-               if ($oldpagemtime{$page}) {
-                       $line.=" link=$_" foreach @{$links{$page}};
+               $line.=" link=$_" foreach @{$links{$page}};
+               if (exists $inlinepages{$page}) {
+                       $line.=" inlinepage=$_" foreach split " ", $inlinepages{$page};

                }
                print OUT $line."\n";
        }
                }
                print OUT $line."\n";
        }


@@ -363,6 +422,7 @@ sub misctemplate ($$) { #{{{
                indexlink => indexlink(),
                wikiname => $config{wikiname},
                pagebody => $pagebody,
                indexlink => indexlink(),
                wikiname => $config{wikiname},
                pagebody => $pagebody,

+               styleurl => styleurl(),

        );
        return $template->output;
 }#}}}
        );
        return $template->output;
 }#}}}


@@ -454,7 +514,13 @@ sub globlist_match ($$) { #{{{
 sub main () { #{{{
        getconfig();
        
 sub main () { #{{{
        getconfig();
        

-       if ($config{setup}) {
+       if ($config{cgi}) {
+               lockwiki();
+               loadindex();
+               require IkiWiki::CGI;
+               cgi();
+       }
+       elsif ($config{setup}) {

                require IkiWiki::Setup;
                setup();
        }
                require IkiWiki::Setup;
                setup();
        }


@@ -463,16 +529,12 @@ sub main () { #{{{
                require IkiWiki::Wrapper;
                gen_wrapper();
        }
                require IkiWiki::Wrapper;
                gen_wrapper();
        }

-       elsif ($config{cgi}) {
-               lockwiki();
-               require IkiWiki::CGI;
-               cgi();
-       }

        else {
                lockwiki();
        else {
                lockwiki();

-               loadindex() unless $config{rebuild};
+               loadindex();

                require IkiWiki::Render;
                rcs_update();
                require IkiWiki::Render;
                rcs_update();

+               rcs_getctime() if $config{getctime};

                refresh();
                saveindex();
        }
                refresh();
                saveindex();
        }