improve fix for symlink attacks to check subdirectories for symlinks too

[ikiwiki.git] / IkiWiki / Render.pm

diff --git a/IkiWiki/Render.pm b/IkiWiki/Render.pm
index 3fdbc6f4a3dd87f5094f71a70f009deb154f9188..9e340c26e162abe5623524d4b4ced32942e6c834 100644 (file)
--- a/IkiWiki/Render.pm
+++ b/IkiWiki/Render.pm
@@ -9,7 +9,8 @@ sub linkify ($$) { #{{{
        my $page=shift;
 
        $content =~ s{(\\?)$config{wiki_link_regexp}}{
-               $1 ? "[[$2]]" : htmllink($page, $2)
+               $2 ? ( $1 ? "[[$2|$3]]" : htmllink($page, titlepage($3), 0, 0, pagetitle($2)))
+                  : ( $1 ? "[[$3]]" :    htmllink($page, titlepage($3)))
        }eg;
        
        return $content;
@@ -138,7 +139,7 @@ sub get_inline_content ($$) { #{{{
        my $file=$pagesources{$page};
        my $type=pagetype($file);
        if ($type ne 'unknown') {
-               return htmlize($type, linkify(readfile("$config{srcdir}/$file"), $parentpage));
+               return htmlize($type, linkify(readfile(srcfile($file)), $parentpage));
        }
        else {
                return "";
@@ -160,12 +161,22 @@ sub postprocess_html_inline { #{{{
        }
        $inlinepages{$parentpage}=$params{pages};
        
+       my $ret="";
+       
+       if (exists $params{rootpage}) {
+               my $formtemplate=HTML::Template->new(blind_cache => 1,
+                       filename => "$config{templatedir}/blogpost.tmpl");
+               $formtemplate->param(cgiurl => $config{cgiurl});
+               $formtemplate->param(rootpage => $params{rootpage});
+               my $form=$formtemplate->output;
+               $ret.=$form;
+       }
+       
        my $template=HTML::Template->new(blind_cache => 1,
                filename => (($params{archive} eq "no") 
                                ? "$config{templatedir}/inlinepage.tmpl"
                                : "$config{templatedir}/inlinepagetitle.tmpl"));
        
-       my $ret="";
        foreach my $page (blog_list($params{pages}, $params{show})) {
                next if $page eq $parentpage;
                $template->param(pagelink => htmllink($parentpage, $page));
@@ -175,7 +186,7 @@ sub postprocess_html_inline { #{{{
                $ret.=$template->output;
        }
        
-       return $ret;
+       return "</p>$ret<p>";
 } #}}}
 
 sub genpage ($$$) { #{{{
@@ -191,10 +202,10 @@ sub genpage ($$$) { #{{{
                filename => "$config{templatedir}/page.tmpl");
        
        if (length $config{cgiurl}) {
-               $template->param(editurl => "$config{cgiurl}?do=edit&page=$page");
-               $template->param(prefsurl => "$config{cgiurl}?do=prefs");
+               $template->param(editurl => cgiurl(do => "edit", page => $page));
+               $template->param(prefsurl => cgiurl(do => "prefs"));
                if ($config{rcs}) {
-                       $template->param(recentchangesurl => "$config{cgiurl}?do=recentchanges");
+                       $template->param(recentchangesurl => cgiurl(do => "recentchanges"));
                }
        }
 
@@ -205,7 +216,7 @@ sub genpage ($$$) { #{{{
        }
 
        if ($config{rss} && $inlinepages{$page}) {
-               $template->param(rssurl => rsspage($page));
+               $template->param(rssurl => rsspage(basename($page)));
        }
        
        $template->param(
@@ -216,6 +227,7 @@ sub genpage ($$$) { #{{{
                backlinks => [backlinks($page)],
                discussionlink => htmllink($page, "Discussion", 1, 1),
                mtime => scalar(gmtime($mtime)),
+               styleurl => styleurl($page),
        );
        
        return $template->output;
@@ -256,8 +268,6 @@ sub genrss ($$$) { #{{{
                my $parentpage=shift;
                my %params=@_;
                
-               return "" if exists $params{archive} && $params{archive} eq 'yes';
-               
                if (! exists $params{show}) {
                        $params{show}=10;
                }
@@ -305,9 +315,9 @@ sub check_overwrite ($$) { #{{{
 } #}}}
 
 sub mtime ($) { #{{{
-       my $page=shift;
+       my $file=shift;
        
-       return (stat($page))[9];
+       return (stat($file))[9];
 } #}}}
 
 sub findlinks ($$) { #{{{
@@ -316,7 +326,7 @@ sub findlinks ($$) { #{{{
 
        my @links;
        while ($content =~ /(?<!\\)$config{wiki_link_regexp}/g) {
-               push @links, lc($1);
+               push @links, titlepage($2);
        }
        # Discussion links are a special case since they're not in the text
        # of the page, but on its template.
@@ -327,7 +337,8 @@ sub render ($) { #{{{
        my $file=shift;
        
        my $type=pagetype($file);
-       my $content=readfile("$config{srcdir}/$file");
+       my $srcfile=srcfile($file);
+       my $content=readfile($srcfile);
        if ($type ne 'unknown') {
                my $page=pagename($file);
                
@@ -338,8 +349,8 @@ sub render ($) { #{{{
                $content=htmlize($type, $content);
                
                check_overwrite("$config{destdir}/".htmlpage($page), $page);
-               writefile("$config{destdir}/".htmlpage($page),
-                       genpage($content, $page, mtime("$config{srcdir}/$file")));
+               writefile(htmlpage($page), $config{destdir},
+                       genpage($content, $page, mtime($srcfile)));
                $oldpagemtime{$page}=time;
                $renderedfiles{$page}=htmlpage($page);
 
@@ -347,14 +358,14 @@ sub render ($) { #{{{
                # check_overwrite, as above, but currently renderedfiles
                # only supports listing one file per page.
                if ($config{rss} && exists $inlinepages{$page}) {
-                       writefile("$config{destdir}/".rsspage($page),
-                               genrss($content, $page, mtime("$config{srcdir}/$file")));
+                       writefile(rsspage($page), $config{destdir},
+                               genrss($content, $page, mtime($srcfile)));
                }
        }
        else {
                $links{$file}=[];
                check_overwrite("$config{destdir}/$file", $file);
-               writefile("$config{destdir}/$file", $content);
+               writefile($file, $config{destdir}, $content);
                $oldpagemtime{$file}=time;
                $renderedfiles{$file}=$file;
        }
@@ -379,9 +390,7 @@ sub refresh () { #{{{
                no_chdir => 1,
                wanted => sub {
                        if (/$config{wiki_file_prune_regexp}/) {
-                               no warnings 'once';
                                $File::Find::prune=1;
-                               use warnings "all";
                        }
                        elsif (! -d $_ && ! -l $_) {
                                my ($f)=/$config{wiki_file_regexp}/; # untaint
@@ -396,6 +405,30 @@ sub refresh () { #{{{
                        }
                },
        }, $config{srcdir});
+       find({
+               no_chdir => 1,
+               wanted => sub {
+                       if (/$config{wiki_file_prune_regexp}/) {
+                               $File::Find::prune=1;
+                       }
+                       elsif (! -d $_ && ! -l $_) {
+                               my ($f)=/$config{wiki_file_regexp}/; # untaint
+                               if (! defined $f) {
+                                       warn("skipping bad filename $_\n");
+                               }
+                               else {
+                                       # Don't add files that are in the
+                                       # srcdir.
+                                       $f=~s/^\Q$config{underlaydir}\E\/?//;
+                                       if (! -e "$config{srcdir}/$f" && 
+                                           ! -l "$config{srcdir}/$f") {
+                                               push @files, $f;
+                                               $exists{pagename($f)}=1;
+                                       }
+                               }
+                       }
+               },
+       }, $config{underlaydir});
 
        my %rendered;
 
@@ -408,7 +441,8 @@ sub refresh () { #{{{
                        push @add, $file;
                        $links{$page}=[];
                        $pagesources{$page}=$file;
-                       $pagectime{$page}=time unless exists $pagectime{$page};
+                       $pagectime{$page}=mtime(srcfile($file))
+                               unless exists $pagectime{$page};
                }
        }
        my @del;
@@ -428,7 +462,7 @@ sub refresh () { #{{{
                my $page=pagename($file);
                
                if (! exists $oldpagemtime{$page} ||
-                   mtime("$config{srcdir}/$file") > $oldpagemtime{$page}) {
+                   mtime(srcfile($file)) > $oldpagemtime{$page}) {
                        debug("rendering changed file $file");
                        render($file);
                        $rendered{$file}=1;