meta: Security fix; don't allow alternative stylesheets to be added on pages where...

[git.ikiwiki.info.git] / IkiWiki / Plugin / graphviz.pm

diff --git a/IkiWiki/Plugin/graphviz.pm b/IkiWiki/Plugin/graphviz.pm
index 5d666e1be68d854e8c4e00f96c627de699521859..4ed8b89f165847832762408c05b0abedc21aaf6c 100644 (file)
--- a/IkiWiki/Plugin/graphviz.pm
+++ b/IkiWiki/Plugin/graphviz.pm
@@ -5,18 +5,28 @@ package IkiWiki::Plugin::graphviz;
 
 use warnings;
 use strict;
 
 use warnings;
 use strict;

-use IkiWiki 2.00;
+use IkiWiki 3.00;

 use IPC::Open2;
 
 use IPC::Open2;
 

-sub import { #{{{
+sub import {
+       hook(type => "getsetup", id => "graphviz", call => \&getsetup);

        hook(type => "preprocess", id => "graph", call => \&graph);
        hook(type => "preprocess", id => "graph", call => \&graph);

-} # }}}
+}
+
+sub getsetup () {
+       return
+               plugin => {
+                       safe => 1,
+                       rebuild => undef,
+                       section => "widget",
+               },
+}

 
 my %graphviz_programs = (
        "dot" => 1, "neato" => 1, "fdp" => 1, "twopi" => 1, "circo" => 1
 );
 
 
 my %graphviz_programs = (
        "dot" => 1, "neato" => 1, "fdp" => 1, "twopi" => 1, "circo" => 1
 );
 

-sub render_graph (\%) { #{{{
+sub render_graph (\%) {

        my %params = %{(shift)};
 
        my $src = "$params{type} g {\n";
        my %params = %{(shift)};
 
        my $src = "$params{type} g {\n";


@@ -27,21 +37,20 @@ sub render_graph (\%) { #{{{
        $src .= "}\n";
 
        # Use the sha1 of the graphviz code as part of its filename.
        $src .= "}\n";
 
        # Use the sha1 of the graphviz code as part of its filename.

-       eval q{use Digest::SHA1};
+       eval q{use Digest::SHA};

        error($@) if $@;
        my $dest=$params{page}."/graph-".
        error($@) if $@;
        my $dest=$params{page}."/graph-".

-               IkiWiki::possibly_foolish_untaint(Digest::SHA1::sha1_hex($src)).
+               IkiWiki::possibly_foolish_untaint(Digest::SHA::sha1_hex($src)).

                ".png";
        will_render($params{page}, $dest);
 
        if (! -e "$config{destdir}/$dest") {
                my $pid;
                ".png";
        will_render($params{page}, $dest);
 
        if (! -e "$config{destdir}/$dest") {
                my $pid;

-               my $sigpipe=0;;
+               my $sigpipe=0;

                $SIG{PIPE}=sub { $sigpipe=1 };
                $pid=open2(*IN, *OUT, "$params{prog} -Tpng");
 
                # open2 doesn't respect "use open ':utf8'"
                $SIG{PIPE}=sub { $sigpipe=1 };
                $pid=open2(*IN, *OUT, "$params{prog} -Tpng");
 
                # open2 doesn't respect "use open ':utf8'"

-               binmode (IN, ':utf8');

                binmode (OUT, ':utf8');
 
                print OUT $src;
                binmode (OUT, ':utf8');
 
                print OUT $src;


@@ -56,13 +65,14 @@ sub render_graph (\%) { #{{{
 
                waitpid $pid, 0;
                $SIG{PIPE}="DEFAULT";
 
                waitpid $pid, 0;
                $SIG{PIPE}="DEFAULT";

-               return  "[[graph ".gettext("failed to run graphviz")."]]" if ($sigpipe);
+               error gettext("failed to run graphviz") if $sigpipe;

 
                if (! $params{preview}) {
                        writefile($dest, $config{destdir}, $png, 1);
                }
                else {
 
                if (! $params{preview}) {
                        writefile($dest, $config{destdir}, $png, 1);
                }
                else {

-                       # can't write the file, so embed it in a data uri
+                       # in preview mode, embed the image in a data uri
+                       # to avoid temp file clutter

                        eval q{use MIME::Base64};
                        error($@) if $@;
                        return "<img src=\"data:image/png;base64,".
                        eval q{use MIME::Base64};
                        error($@) if $@;
                        return "<img src=\"data:image/png;base64,".


@@ -70,17 +80,17 @@ sub render_graph (\%) { #{{{
                }
        }
 
                }
        }
 

-       return "<img src=\"".urlto($dest, $params{page})."\" />\n";
-} #}}}
+       return "<img src=\"".urlto($dest, $params{destpage})."\" />\n";
+}

 
 

-sub graph (@) { #{{{
+sub graph (@) {

        my %params=@_;
        $params{src} = "" unless defined $params{src};
        $params{type} = "digraph" unless defined $params{type};
        $params{prog} = "dot" unless defined $params{prog};
        my %params=@_;
        $params{src} = "" unless defined $params{src};
        $params{type} = "digraph" unless defined $params{type};
        $params{prog} = "dot" unless defined $params{prog};

-       return "[[graph ".gettext("prog not a valid graphviz program")."]]" unless $graphviz_programs{$params{prog}};
+       error gettext("prog not a valid graphviz program") unless $graphviz_programs{$params{prog}};

 
        return render_graph(%params);
 
        return render_graph(%params);

-} # }}}
+}

 
 1
 
 1