X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/7dd074e2e712c67c8c1a26841a69281fa9d293cb..f3abeac919c4736429bd3362af6edf51ede8e7fe:/IkiWiki/Render.pm diff --git a/IkiWiki/Render.pm b/IkiWiki/Render.pm index c82d8a35a..44b2fb9c2 100644 --- a/IkiWiki/Render.pm +++ b/IkiWiki/Render.pm @@ -78,11 +78,14 @@ sub genpage ($$) { my $actions=0; if (length $config{cgiurl}) { - $template->param(editurl => cgiurl(do => "edit", page => $page)) - if IkiWiki->can("cgi_editpage"); - $template->param(prefsurl => cgiurl(do => "prefs")) - if exists $hooks{auth}; - $actions++; + if (IkiWiki->can("cgi_editpage")) { + $template->param(editurl => cgiurl(do => "edit", page => $page)); + $actions++; + } + if (exists $hooks{auth}) { + $template->param(prefsurl => cgiurl(do => "prefs")); + $actions++; + } } if (defined $config{historyurl} && length $config{historyurl}) { @@ -277,6 +280,27 @@ sub srcdir_check () { } +sub verify_src_file ($$) { + my $file=decode_utf8(shift); + my $dir=shift; + + return if -l $file || -d $file; + $file=~s/^\Q$dir\E\/?//; + return if ! length $file; + my $page = pagename($file); + if (! exists $pagesources{$page} && + file_pruned($file)) { + $File::Find::prune=1; + return; + } + + my ($f) = $file =~ /$config{wiki_file_regexp}/; # untaint + if (! defined $f) { + warn(sprintf(gettext("skipping bad filename %s"), $file)."\n"); + } + return ($file,$page,$f); +} + sub find_src_files () { my @files; my %pages; @@ -285,22 +309,9 @@ sub find_src_files () { find({ no_chdir => 1, wanted => sub { - my $file=decode_utf8($_); - $file=~s/^\Q$config{srcdir}\E\/?//; - return if -l $_ || -d _ || ! length $file; - my $page = pagename($file); - if (! exists $pagesources{$page} && - file_pruned($file)) { - $File::Find::prune=1; - return; - } - - my ($f) = $file =~ /$config{wiki_file_regexp}/; # untaint - if (! defined $f) { - warn(sprintf(gettext("skipping bad filename %s"), $file)."\n"); - } - else { - push @files, $f; + my ($file,$page,$f) = verify_src_file($_,$config{srcdir}); + if ($file) { + push @files, $file; if ($pages{$page}) { debug(sprintf(gettext("%s has multiple possible source pages"), $page)); } @@ -312,24 +323,11 @@ sub find_src_files () { find({ no_chdir => 1, wanted => sub { - my $file=decode_utf8($_); - $file=~s/^\Q$dir\E\/?//; - return if -l $_ || -d _ || ! length $file; - my $page=pagename($file); - if (! exists $pagesources{$page} && - file_pruned($file)) { - $File::Find::prune=1; - return; - } - - my ($f) = $file =~ /$config{wiki_file_regexp}/; # untaint - if (! defined $f) { - warn(sprintf(gettext("skipping bad filename %s"), $file)."\n"); - } - else { + my ($file,$page,$f) = verify_src_file($_,$dir); + if ($f) { # avoid underlaydir override # attacks; see security.mdwn - if (! -l "$config{srcdir}/$f" && + if (! -l "$config{srcdir}/$f" && ! -e _) { if (! $pages{$page}) { push @files, $f;