cloak user PII when making commits etc, and let cloaked PII be used in banned_users

This was needed due to emailauth, but I've also wrapped all IP address
exposure in cloak(), although the function doesn't yet cloak IP addresses.

(One IP address I didn't cloak is the one that appears on the password
reset email template. That is expected to be the user's own IP address,
so ok to show it to them.)

Thanks to smcv for the pointer to
http://xmlns.com/foaf/spec/#term_mbox_sha1sum

diff --git a/IkiWiki.pm b/IkiWiki.pm
index dfdd0fe910556490d42a0faf67c8d6c4779ec15f..bb36b0885e8c43ff0b913c850935d18d7cf81529 100644 (file)
--- a/IkiWiki.pm
+++ b/IkiWiki.pm
@@ -1430,6 +1430,7 @@ sub userpage ($) {
        return length $config{userdir} ? "$config{userdir}/$user" : $user;
 }
 
+# Username to display for openid accounts.
 sub openiduser ($) {
        my $user=shift;
 
@@ -1464,6 +1465,7 @@ sub openiduser ($) {
        return;
 }
 
+# Username to display for emailauth accounts. 
 sub emailuser ($) {
        my $user=shift;
        if (defined $user && $user =~ m/(.+)@/) {
@@ -1475,6 +1477,22 @@ sub emailuser ($) {
        return;
 }
 
+# Some user information should not be exposed in commit metadata, etc.
+# This generates a cloaked form of such information.
+sub cloak ($) {
+       my $user=shift;
+       # cloak email address using http://xmlns.com/foaf/spec/#term_mbox_sha1sum
+       if ($user=~m/(.+)@/) {
+               my $nick=$1;
+               eval q{use Digest::SHA};
+               return $user if $@;
+               return $nick.'@'.Digest::SHA::sha1_hex("mailto:$user");
+       }
+       else {
+               return $user;
+       }
+}
+
 sub htmlize ($$$$) {
        my $page=shift;
        my $destpage=shift;

diff --git a/IkiWiki/CGI.pm b/IkiWiki/CGI.pm
index d801c72a00c1be4d2a8bae752822de91b3c1e69f..1763828a4eef973fce3296e2ffdd452f22e0a058 100644 (file)
--- a/IkiWiki/CGI.pm
+++ b/IkiWiki/CGI.pm
@@ -336,16 +336,19 @@ sub check_banned ($$) {
 
        my $banned=0;
        my $name=$session->param("name");
+       my $cloak=cloak($name) if defined $name;
        if (defined $name && 
-           grep { $name eq $_ } @{$config{banned_users}}) {
+           grep { $name eq $_ || $cloak eq $_ } @{$config{banned_users}}) {
                $banned=1;
        }
 
        foreach my $b (@{$config{banned_users}}) {
                if (pagespec_match("", $b,
                        ip => $session->remote_addr(),
-                       name => defined $name ? $name : "",
-               )) {
+                       name => defined $name ? $name : "")
+                  || pagespec_match("", $b,
+                       ip => cloak($session->remote_addr()),
+                       name => defined $cloak ? $cloak : "")) {
                        $banned=1;
                        last;
                }

diff --git a/IkiWiki/Plugin/bzr.pm b/IkiWiki/Plugin/bzr.pm
index e2b102dee9403014271edc26e6683eb7a1933e5a..5ec254f84ff9af7a9a3cd69b73902923b43527bc 100644 (file)
--- a/IkiWiki/Plugin/bzr.pm
+++ b/IkiWiki/Plugin/bzr.pm
@@ -133,10 +133,10 @@ sub bzr_author ($) {
        my $ipaddr=$session->remote_addr();
 
        if (defined $user) {
-               return IkiWiki::possibly_foolish_untaint($user);
+               return IkiWiki::possibly_foolish_untaint(IkiWiki::cloak($user));
        }
        elsif (defined $ipaddr) {
-               return "Anonymous from ".IkiWiki::possibly_foolish_untaint($ipaddr);
+               return "Anonymous from ".IkiWiki::possibly_foolish_untaint(IkiWiki::cloak($ipaddr));
        }
        else {
                return "Anonymous";

diff --git a/IkiWiki/Plugin/comments.pm b/IkiWiki/Plugin/comments.pm
index eaa924e517222656233ea7261d58b2f709c51f3b..ad813d19d7e669c189342140c9d166d94968b4e7 100644 (file)
--- a/IkiWiki/Plugin/comments.pm
+++ b/IkiWiki/Plugin/comments.pm
@@ -466,7 +466,7 @@ sub editcomment ($$) {
        my $content = "[[!comment format=$type\n";
 
        if (defined $session->param('name')) {
-               my $username = $session->param('name');
+               my $username = IkiWiki::cloak($session->param('name'));
                $username =~ s/"/"/g;
                $content .= " username=\"$username\"\n";
        }
@@ -479,7 +479,7 @@ sub editcomment ($$) {
 
        if (!(defined $session->param('name') || defined $session->param('nickname')) &&
                defined $session->remote_addr()) {
-               $content .= " ip=\"".$session->remote_addr()."\"\n";
+               $content .= " ip=\"".IkiWiki::cloak($session->remote_addr())."\"\n";
        }
 
        if ($config{comments_allowauthor}) {

diff --git a/IkiWiki/Plugin/cvs.pm b/IkiWiki/Plugin/cvs.pm
index 841aec914f7208df52036379319f4bdfda7ddc01..8989a26e377a8ae61cda22ecf794a83f045e9a18 100644 (file)
--- a/IkiWiki/Plugin/cvs.pm
+++ b/IkiWiki/Plugin/cvs.pm
@@ -456,12 +456,12 @@ sub commitmessage (@) {
        if (defined $params{session}) {
                if (defined $params{session}->param("name")) {
                        return "web commit by ".
-                               $params{session}->param("name").
+                               IkiWiki::cloak($params{session}->param("name")).
                                (length $params{message} ? ": $params{message}" : "");
                }
                elsif (defined $params{session}->remote_addr()) {
                        return "web commit from ".
-                               $params{session}->remote_addr().
+                               IkiWiki::cloak($params{session}->remote_addr()).
                                (length $params{message} ? ": $params{message}" : "");
                }
        }

diff --git a/IkiWiki/Plugin/darcs.pm b/IkiWiki/Plugin/darcs.pm
index 646f65df10688087decd275e0be6109203573aae..9dccd95a43766c34c144ad51e6076418f97b3d54 100644 (file)
--- a/IkiWiki/Plugin/darcs.pm
+++ b/IkiWiki/Plugin/darcs.pm
@@ -147,10 +147,10 @@ sub commitauthor (@) {
        my $author="anon\@web";
        if (defined $params{session}) {
                if (defined $params{session}->param("name")) {
-                       return $params{session}->param("name").'@web';
+                       return IkiWiki::cloak($params{session}->param("name")).'@web';
                }
                elsif (defined $params{session}->remote_addr()) {
-                       return $params{session}->remote_addr().'@web';
+                       return IkiWiki::cloak($params{session}->remote_addr()).'@web';
                }
        }
        return 'anon@web';

diff --git a/IkiWiki/Plugin/git.pm b/IkiWiki/Plugin/git.pm
index 75b89e476bbb4bf1da262385a8e390994489f0e9..4d48388a04fdc2e9c3d6ea7c71b40d3ba3ccd88c 100644 (file)
--- a/IkiWiki/Plugin/git.pm
+++ b/IkiWiki/Plugin/git.pm
@@ -579,7 +579,7 @@ sub rcs_commit_helper (@) {
                        $u=$params{session}->remote_addr();
                }
                if (defined $u) {
-                       $u=encode_utf8($u);
+                       $u=encode_utf8(IkiWiki::cloak($u));
                        $ENV{GIT_AUTHOR_NAME}=$u;
                }
                if (defined $params{session}->param("nickname")) {

diff --git a/IkiWiki/Plugin/mercurial.pm b/IkiWiki/Plugin/mercurial.pm
index 8da4ceb07ada8f026e908be1004d060e9e21adeb..9f0c5b721ccf13b26325eb5ba299ddbb4f0b7f2b 100644 (file)
--- a/IkiWiki/Plugin/mercurial.pm
+++ b/IkiWiki/Plugin/mercurial.pm
@@ -183,10 +183,10 @@ sub rcs_commit_helper (@) {
        my $user="Anonymous";
        if (defined $params{session}) {
                if (defined $params{session}->param("name")) {
-                       $user = $params{session}->param("name");
+                       $user = IkiWiki::cloak($params{session}->param("name"));
                }
                elsif (defined $params{session}->remote_addr()) {
-                       $user = $params{session}->remote_addr();
+                       $user = IkiWiki::cloak($params{session}->remote_addr());
                }
 
                my $nickname=$user;

diff --git a/IkiWiki/Plugin/monotone.pm b/IkiWiki/Plugin/monotone.pm
index 105627814b793fa5ff868ceff7c07e00c3dd9078..b0bba5661541843bb1440bffe5c466ae88dc238d 100644 (file)
--- a/IkiWiki/Plugin/monotone.pm
+++ b/IkiWiki/Plugin/monotone.pm
@@ -310,10 +310,10 @@ sub commitauthor (@) {
 
        if (defined $params{session}) {
                if (defined $params{session}->param("name")) {
-                       return "Web user: " . $params{session}->param("name");
+                       return "Web user: " . IkiWiki::cloak($params{session}->param("name"));
                }
                elsif (defined $params{session}->remote_addr()) {
-                       return "Web IP: " . $params{session}->remote_addr();
+                       return "Web IP: " . IkiWiki::cloak($params{session}->remote_addr());
                }
        }
        return "Web: Anonymous";

diff --git a/IkiWiki/Plugin/svn.pm b/IkiWiki/Plugin/svn.pm
index fd11f2c637597d98915f6a5bc29fc03ff6d0c572..c46a52dcf398a0a65a333414a795563e2e440b0f 100644 (file)
--- a/IkiWiki/Plugin/svn.pm
+++ b/IkiWiki/Plugin/svn.pm
@@ -147,12 +147,12 @@ sub commitmessage (@) {
        if (defined $params{session}) {
                if (defined $params{session}->param("name")) {
                        return "web commit by ".
-                               $params{session}->param("name").
+                               IkiWiki::cloak($params{session}->param("name")).
                                (length $params{message} ? ": $params{message}" : "");
                }
                elsif (defined $params{session}->remote_addr()) {
                        return "web commit from ".
-                               $params{session}->remote_addr().
+                               IkiWiki::cloak($params{session}->remote_addr()).
                                (length $params{message} ? ": $params{message}" : "");
                }
        }

diff --git a/IkiWiki/Plugin/tla.pm b/IkiWiki/Plugin/tla.pm
index 11be248e8da9d90fe050da1ad57f643a7ae0cdf1..c2fffbcedba5a27cafb54fd686cbe6ae1f63b979 100644 (file)
--- a/IkiWiki/Plugin/tla.pm
+++ b/IkiWiki/Plugin/tla.pm
@@ -108,12 +108,12 @@ sub rcs_commit (@) {
        if (defined $params{session}) {
                if (defined $params{session}->param("name")) {
                        $message="web commit by ".
-                               $params{session}->param("name").
+                               IkiWiki::cloak($params{session}->param("name")).
                                (length $message ? ": $message" : "");
                }
                elsif (defined $params{session}->remote_addr()) {
                        $message="web commit from ".
-                               $params{session}->remote_addr().
+                               IkiWiki::cloak($params{session}->remote_addr()).
                                (length $message ? ": $message" : "");
                }
        }

diff --git a/doc/banned_users.mdwn b/doc/banned_users.mdwn
index c44f8c587fd12af58e0f0e0275e76d7123b2b57b..23433b15b3426c08e030e072dc8163add7d2afde 100644 (file)
--- a/doc/banned_users.mdwn
+++ b/doc/banned_users.mdwn
@@ -8,3 +8,7 @@ For example:
 
 If a banned user attempts to use the ikiwiki CGI, they will receive a 403
 Forbidden webpage indicating they are banned.
+
+Note that when [[plugins/emailauth]] is used, the user's email address
+is displayed in cloaked form in commits of their edits. This cloaked email
+address can be used as-is in the `banned_users` setting.

diff --git a/doc/plugins/emailauth.mdwn b/doc/plugins/emailauth.mdwn
index db22e29319423cf03b2eb73afcea89db23c53e60..74097d2cc2cebf61f1b122391005865a291eb9a6 100644 (file)
--- a/doc/plugins/emailauth.mdwn
+++ b/doc/plugins/emailauth.mdwn
@@ -11,8 +11,10 @@ some other form of authentication, such as [[passwordauth]] or [[openid]].
 Users who have logged in using emailauth will have their email address used as
 their username. In places where the username is displayed, like the
 RecentChanges page, the domain will be omitted, to avoid exposing the
-user's email address. Note though that the email address will be visible
-when looking at eg, commits in the git repository.
+user's email address. In places where the full username needs to be put,
+like commits of changes, the email address is cloaked using
+<a href="http://xmlns.com/foaf/spec/#term_mbox_sha1sum">the
+foaf:mbox_sha1sum spec</a>.
 
 This plugin needs the [[!cpan Mail::SendMail]] perl module installed,
 and able to send outgoing email.

diff --git a/doc/todo/emailauth.mdwn b/doc/todo/emailauth.mdwn
index 357a4ad9bbadf1b007b1297c6e3d034533be7674..4683bbad29c0d5b3674ee1abfd2c902f9b6bdb85 100644 (file)
--- a/doc/todo/emailauth.mdwn
+++ b/doc/todo/emailauth.mdwn
@@ -131,4 +131,6 @@ Thoughts anyone? --[[Joey]]
 >>> from `smcv <smcv@debian.org>` - if the hash is of `mailto:whatever`
 >>> (like my example one) then it's compatible with
 >>> [FOAF](http://xmlns.com/foaf/spec/#term_mbox_sha1sum).
->>> --[[smcv]]
+>>> --[[smcv]]a
+
+>>> Email addresses are now cloaked in commits, using foaf:mbox_sha1sum. --[[Joey]]