* Fix a security hole that allowed a web user to edit images and other

[git.ikiwiki.info.git] / IkiWiki / Plugin / aggregate.pm

diff --git a/IkiWiki/Plugin/aggregate.pm b/IkiWiki/Plugin/aggregate.pm
index 8c4b1bfe930c6bdc133160cf9a24483f490a64d5..7fceb0df3d54112478f25ab946477bd418416ee5 100644 (file)
--- a/IkiWiki/Plugin/aggregate.pm
+++ b/IkiWiki/Plugin/aggregate.pm
@@ -25,6 +25,7 @@ sub import { #{{{
 
 sub getopt () { #{{{
         eval q{use Getopt::Long};
 
 sub getopt () { #{{{
         eval q{use Getopt::Long};

+       error($@) if $@;

         Getopt::Long::Configure('pass_through');
         GetOptions("aggregate" => \$config{aggregate});
 } #}}}
         Getopt::Long::Configure('pass_through');
         GetOptions("aggregate" => \$config{aggregate});
 } #}}}


@@ -57,7 +58,7 @@ sub preprocess (@) { #{{{
 
        foreach my $required (qw{name url}) {
                if (! exists $params{$required}) {
 
        foreach my $required (qw{name url}) {
                if (! exists $params{$required}) {

-                       return "[[aggregate plugin missing $required parameter]]";
+                       return "[[".sprintf(gettext("aggregate plugin missing %s parameter"), $required)."]]";

                }
        }
 
                }
        }
 


@@ -85,7 +86,7 @@ sub preprocess (@) { #{{{
        $feed->{lastupdate}=0 unless defined $feed->{lastupdate};
        $feed->{numposts}=0 unless defined $feed->{numposts};
        $feed->{newposts}=0 unless defined $feed->{newposts};
        $feed->{lastupdate}=0 unless defined $feed->{lastupdate};
        $feed->{numposts}=0 unless defined $feed->{numposts};
        $feed->{newposts}=0 unless defined $feed->{newposts};

-       $feed->{message}="new feed" unless defined $feed->{message};
+       $feed->{message}=gettext("new feed") unless defined $feed->{message};

        $feed->{error}=0 unless defined $feed->{error};
        $feed->{tags}=[];
        while (@_) {
        $feed->{error}=0 unless defined $feed->{error};
        $feed->{tags}=[];
        while (@_) {


@@ -99,8 +100,9 @@ sub preprocess (@) { #{{{
        return "<a href=\"".$feed->{url}."\">".$feed->{name}."</a>: ".
               ($feed->{error} ? "<em>" : "").$feed->{message}.
               ($feed->{error} ? "</em>" : "").
        return "<a href=\"".$feed->{url}."\">".$feed->{name}."</a>: ".
               ($feed->{error} ? "<em>" : "").$feed->{message}.
               ($feed->{error} ? "</em>" : "").

-              " (".$feed->{numposts}." posts".
-              ($feed->{newposts} ? "; ".$feed->{newposts}." new" : "").
+              " (".$feed->{numposts}." ".gettext("posts").
+              ($feed->{newposts} ? "; ".$feed->{newposts}.
+                                   " ".gettext("new") : "").

               ")";
 } # }}}
 
               ")";
 } # }}}
 


@@ -150,7 +152,7 @@ sub loadstate () { #{{{
 
 sub savestate () { #{{{
        eval q{use HTML::Entities};
 
 sub savestate () { #{{{
        eval q{use HTML::Entities};

-       die $@ if $@;
+       error($@) if $@;

        open (OUT, ">$config{wikistatedir}/aggregate" ||
                die "$config{wikistatedir}/aggregate: $!");
        foreach my $data (values %feeds, values %guids) {
        open (OUT, ">$config{wikistatedir}/aggregate" ||
                die "$config{wikistatedir}/aggregate: $!");
        foreach my $data (values %feeds, values %guids) {


@@ -201,13 +203,14 @@ sub expire () { #{{{
                        if ($feed->{expireage}) {
                                my $days_old = (time - $IkiWiki::pagectime{$item->{page}}) / 60 / 60 / 24;
                                if ($days_old > $feed->{expireage}) {
                        if ($feed->{expireage}) {
                                my $days_old = (time - $IkiWiki::pagectime{$item->{page}}) / 60 / 60 / 24;
                                if ($days_old > $feed->{expireage}) {

-                                       debug("expiring ".$item->{page}." ($days_old days old)");
+                                       debug(sprintf(gettext("expiring %s (%s days old)"),
+                                               $item->{page}, $days_old));

                                        $item->{expired}=1;
                                }
                        }
                        elsif ($feed->{expirecount} &&
                               $count >= $feed->{expirecount}) {
                                        $item->{expired}=1;
                                }
                        }
                        elsif ($feed->{expirecount} &&
                               $count >= $feed->{expirecount}) {

-                               debug("expiring ".$item->{page});
+                               debug(sprintf(gettext("expiring %s"), $item->{page}));

                                $item->{expired}=1;
                        }
                        else {
                                $item->{expired}=1;
                        }
                        else {


@@ -219,9 +222,9 @@ sub expire () { #{{{
 
 sub aggregate () { #{{{
        eval q{use XML::Feed};
 
 sub aggregate () { #{{{
        eval q{use XML::Feed};

-       die $@ if $@;
+       error($@) if $@;

        eval q{use HTML::Entities};
        eval q{use HTML::Entities};

-       die $@ if $@;
+       error($@) if $@;

 
        foreach my $feed (values %feeds) {
                next unless $config{rebuild} || 
 
        foreach my $feed (values %feeds) {
                next unless $config{rebuild} || 


@@ -230,12 +233,12 @@ sub aggregate () { #{{{
                $feed->{newposts}=0;
                $IkiWiki::forcerebuild{$feed->{sourcepage}}=1;
 
                $feed->{newposts}=0;
                $IkiWiki::forcerebuild{$feed->{sourcepage}}=1;
 

-               debug("checking feed ".$feed->{name}." ...");
+               debug(sprintf(gettext("checking feed %s ..."), $feed->{name}));

 
                if (! length $feed->{feedurl}) {
                        my @urls=XML::Feed->find_feeds($feed->{url});
                        if (! @urls) {
 
                if (! length $feed->{feedurl}) {
                        my @urls=XML::Feed->find_feeds($feed->{url});
                        if (! @urls) {

-                               $feed->{message}="could not find feed at ".$feed->{feedurl};
+                               $feed->{message}=sprintf(gettext("could not find feed at %s"), $feed->{feedurl});

                                $feed->{error}=1;
                                debug($feed->{message});
                                next;
                                $feed->{error}=1;
                                debug($feed->{message});
                                next;


@@ -244,7 +247,7 @@ sub aggregate () { #{{{
                }
                my $f=eval{XML::Feed->parse(URI->new($feed->{feedurl}))};
                if ($@) {
                }
                my $f=eval{XML::Feed->parse(URI->new($feed->{feedurl}))};
                if ($@) {

-                       $feed->{message}="feed crashed XML::Feed! $@";
+                       $feed->{message}=gettext("feed crashed XML::Feed!")." ($@)";

                        $feed->{error}=1;
                        debug($feed->{message});
                        next;
                        $feed->{error}=1;
                        debug($feed->{message});
                        next;


@@ -267,8 +270,8 @@ sub aggregate () { #{{{
                        );
                }
 
                        );
                }
 

-               $feed->{message}="processed ok at ".
-                       displaytime($feed->{lastupdate});
+               $feed->{message}=sprintf(gettext("processed ok at %s"),
+                       displaytime($feed->{lastupdate}));

                $feed->{error}=0;
        }
 } #}}}
                $feed->{error}=0;
        }
 } #}}}


@@ -307,8 +310,22 @@ sub add_page (@) { #{{{
                       -e pagefile($page.$c)) {
                        $c++
                }
                       -e pagefile($page.$c)) {
                        $c++
                }

+
+               # Make sure that the file name isn't too long. 
+               # NB: This doesn't check for path length limits.
+               eval q{use POSIX};
+               my $max=POSIX::pathconf($config{srcdir}, &POSIX::_PC_NAME_MAX);
+               if (defined $max && length(htmlpage($page)) >= $max) {
+                       $c="";
+                       $page=$feed->{dir}."/item";
+                       while (exists $IkiWiki::pagecase{lc $page.$c} ||
+                              -e pagefile($page.$c)) {
+                               $c++
+                       }
+               }
+

                $guid->{page}=$page;
                $guid->{page}=$page;

-               debug("creating new page $page");
+               debug(sprintf(gettext("creating new page %s"), $page));

        }
        $guid->{feed}=$feed->{name};
        
        }
        $guid->{feed}=$feed->{name};
        


@@ -316,6 +333,7 @@ sub add_page (@) { #{{{
        # to avoid unneccessary rebuilding. The mtime from rss cannot be
        # trusted; let's use a digest.
        eval q{use Digest::MD5 'md5_hex'};
        # to avoid unneccessary rebuilding. The mtime from rss cannot be
        # trusted; let's use a digest.
        eval q{use Digest::MD5 'md5_hex'};

+       error($@) if $@;

        require Encode;
        my $digest=md5_hex(Encode::encode_utf8($params{content}));
        return unless ! exists $guid->{md5} || $guid->{md5} ne $digest || $config{rebuild};
        require Encode;
        my $digest=md5_hex(Encode::encode_utf8($params{content}));
        return unless ! exists $guid->{md5} || $guid->{md5} ne $digest || $config{rebuild};