use toggles

[git.ikiwiki.info.git] / doc / patchqueue / various_fixes.mdwn

diff --git a/doc/patchqueue/various_fixes.mdwn b/doc/patchqueue/various_fixes.mdwn
index 8de4974e47ca194a56698f0c3bd69c5cfa6e6deb..318e7e941c7c7d5b1eb04ae769296786d543bbf7 100644 (file)
--- a/doc/patchqueue/various_fixes.mdwn
+++ b/doc/patchqueue/various_fixes.mdwn
@@ -36,6 +36,21 @@ sure what the CGI was running under.
 > Can you reproduce the problem running svn info outside of ikiwiki?
 > --[[Joey]]
 
 > Can you reproduce the problem running svn info outside of ikiwiki?
 > --[[Joey]]
 

+>> I've now managed to reproduce the problem. I'll try and give some more information.
+>> When going to the Recent Changes link I get 
+
+    [Sat Sep 16 15:16:08 2006] [error] [client xxxx] svn: Can't check path '/home/jw2328/.subversion': Permission denied, referer: http://xxxxx/test/sandbox.html
+    [Sat Sep 16 15:16:08 2006] [error] [client xxxx] Use of uninitialized value in concatenation (.) or string at /usr/lib/perl5/site_perl/5.8.3/IkiWiki/Rcs/svn.pm line 145., referer: http://xxxx/test/sandbox.html
+    [Sat Sep 16 15:16:08 2006] [error] [client xxxxx] svn: Can't check path '/home/jw2328/.subversion': Permission denied, referer: http://xxxx/test/sandbox.html
+    [Sat Sep 16 15:16:09 2006] [error] [client xxxx] File does not exist:  at /usr/lib/perl5/site_perl/5.8.3/IkiWiki/Rcs/svn.pm line 145, referer: http://xxxx/test/sandbox.html
+    [Sat Sep 16 15:16:09 2006] [error] [client xxxx] Premature end of script headers: ikitest, referer: http://xxxx/test/sandbox.html
+
+>> which the $svn_url is causing the uninitialised value, due to the 
+>> LANG=C it seems, as if I remove it it goes away.
+>> The file does not exist is due to the unreadable .subversion.
+>> echoing the LANG before it is set shows that the variable is normally 
+>> empty for the user that is running it.
+

 The second removes problems with cannot access /home/$user/.svnsomething in
 the logs. I think this problem was also fatal (I should have reported these
 sooner). 
 The second removes problems with cannot access /home/$user/.svnsomething in
 the logs. I think this problem was also fatal (I should have reported these
 sooner). 


@@ -57,26 +72,20 @@ much help I'm afraid.
 > 
 > What's the error message? --[[Joey]]
 
 > 
 > What's the error message? --[[Joey]]
 

-----
+>> `svn: Can't check path '/home/jw2328/.subversion': Permission denied,`
+>> where jw2328 is my usual user. 
+>> I have restrictive permissions of 0700 on home dirs on the server,
+>> and the CGI is running as uid apache, euid root. (Not my setup anymore).
+>> The way I had it set up, was jw2328 owning thesource dir, and the svn repo,
+>> with g+sw on them both. I ran sudo ikiwiki --setup though, as I was reluctant
+>> to adjust permissions on my cgi-dir. This seems to be the root of the 
+>> problem.
+
+>>> Ah, I think it's better to keep the permissions of the repository
+>>> and source directory sane (755) and make the cgi suid to your user,
+>>> which is how it's designed to work.

 
 

-    --- IkiWiki/Plugin/search.pm
-    +++ IkiWiki/Plugin/search.pm
-    @@ -99,7 +99,7 @@
-            close TEMPLATE;
-            $cgi="$estdir/".IkiWiki::basename($config{cgiurl});
-            unlink($cgi);
-    -       symlink("/usr/lib/estraier/estseek.cgi", $cgi) ||
-    +       symlink("/usr/local/libexec/estseek.cgi", $cgi) ||
-                    error("symlink $cgi: $!");
-     } # }}}
-
-obviously I'm not asking you to include this patch, but it would
-be good if this sort of thing was configurable (at build time?). I can
-have a go if you like, but I'm not sure what would be acceptable to
-you.
-
-> This should be made configurable via an option in %IkiWiki::config,
-> the search plugin could register a getopt hook to handle it. --[[Joey]]
+>>>> I realise that now, and I now have a much more sane setup that works.

 
 ----
 
 
 ----
 


@@ -133,25 +142,31 @@ informative if that code path is ever taken, but I hope that it never is.
 > 
 > --[[Joey]]
 
 > 
 > --[[Joey]]
 

-----
-
-As for backports there is a problem with the sarge version of libcgi-session-perl
-and my sslcookie patch (complaints about a missing include file auto/CGI/Session/cookie.al IIRC).
-This file does not and has not ever existed, but it appears to be fixed in 
-the backport of libcgi-session-perl that I did. That puts the dependency
-required at somewhere between 3.95-2 and 4.14-1. This could then be added
-to debian/control. It would mean one more package to backport, but stops the
-bug if anyone actually uses my sslcookie option except me.
-
-> May as well, done --[[Joey]]
-
-As for backports I managed with 
-
- * ikiwiki_1.26
- * libcgi-formbuilder-perl_3.03.01-1
- * libcgi-session-perl_4.14-1
-
-backported to sarge, with bpo in sources.list. This only covers Depends: though,
-for instance hyperestraier needs to be backported, which I haven't got
-round to yet as there is a chain to do.
-
+>> It seems like it is always the (with instrumentation)
+     
+     elsif ($word =~ /^(link|backlink|created_before|created_after|creation_month|creation_year|creation_day)\((.+)\)$/) {
+          warn("\$1 tainted=".tainted($1).", \$2 tainted=".tainted($2)." \$code tainted=".tainted($code));
+          $code.=" match_$1(\$page, ".safequote($2).")";
+          warn("\$1 tainted=".tainted($1).", \$2 tainted=".tainted($2)." \$code tainted=".tainted($code));
+          warn("safequote tainted=".tainted(safequote($2)));
+     }
+
+>> bit that causes it. With the following trace:
+
+     $1 tainted=0, $2 tainted=0 $code tainted=0 at IkiWiki.pm line 718.
+     $1 tainted=0, $2 tainted=0 $code tainted=1 at IkiWiki.pm line 720.
+     safequote tainted=0 at IkiWiki.pm line 721.
+
+>> which shows that `$code` appears to become tainted from nowhere.
+>> <http://mail-archives.apache.org/mod_mbox/spamassassin-dev/200509.mbox/%3C3838.431C7D9B.5F152B8F.dev@spamassassin.apache.org%3E>
+>> is what pointed me to find the problem/workaround.
+
+>>> Given that verification, an untaint contingent on the value of $^V
+>>> sounds reasonable and I'd accept such a patch. I'm not quite sure which
+>>> version(s) of perl it should check for.
+
+>>>> I'm not going to write one though. I don't know what versions either,
+>>>> but I think the evil of the special case is too much in this case. If
+>>>> you are happy to insist on a newer version of perl then I will leave 
+>>>> it at that and sort something out locally. If you want the patch I will 
+>>>> code it though, as I realise you may want to support sarge installs.