web commit by AlexandreDupas: possible answer

[ikiwiki.git] / IkiWiki / Render.pm

diff --git a/IkiWiki/Render.pm b/IkiWiki/Render.pm
index 37383384d619c02d32dcb99ab49b284f61977331..4fefadf09d5994c982735da22f6da194a563be50 100644 (file)
--- a/IkiWiki/Render.pm
+++ b/IkiWiki/Render.pm
@@ -44,11 +44,7 @@ sub backlinks ($) { #{{{
                               
                push @links, { url => $href, page => pagetitle($p_trimmed) };
        }
-       @links = sort { $a->{page} cmp $b->{page} } @links;
-
-       return \@links, [] if @links <= $config{numbacklinks} || ! $config{numbacklinks};
-       return [@links[0..$config{numbacklinks}-1]],
-              [@links[$config{numbacklinks}..$#links]];
+       return @links;
 } #}}}
 
 sub parentlinks ($) { #{{{
@@ -59,8 +55,8 @@ sub parentlinks ($) { #{{{
        my $path="";
        my $title=$config{wikiname};
        
-       return if $page eq 'index'; # toplevel
        foreach my $dir (split("/", $page)) {
+               next if $dir eq 'index';
                push @ret, { url => urlto($path, $page), page => $title };
                $path.="/".$dir;
                $title=pagetitle($dir);
@@ -68,12 +64,19 @@ sub parentlinks ($) { #{{{
        return @ret;
 } #}}}
 
-sub genpage ($$$) { #{{{
+sub genpage ($$) { #{{{
        my $page=shift;
        my $content=shift;
-       my $mtime=shift;
 
-       my $template=template("page.tmpl", blind_cache => 1);
+       my $templatefile;
+       run_hooks(templatefile => sub {
+               return if defined $templatefile;
+               my $file=shift->(page => $page);
+               if (defined $file && defined template_file($file)) {
+                       $templatefile=$file;
+               }
+       });
+       my $template=template(defined $templatefile ? $templatefile : 'page.tmpl', blind_cache => 1);
        my $actions=0;
 
        if (length $config{cgiurl}) {
@@ -105,7 +108,16 @@ sub genpage ($$$) { #{{{
                $template->param(have_actions => 1);
        }
 
-       my ($backlinks, $more_backlinks)=backlinks($page);
+       my @backlinks=sort { $a->{page} cmp $b->{page} } backlinks($page);
+       my ($backlinks, $more_backlinks);
+       if (@backlinks <= $config{numbacklinks} || ! $config{numbacklinks}) {
+               $backlinks=\@backlinks;
+               $more_backlinks=[];
+       }
+       else {
+               $backlinks=[@backlinks[0..$config{numbacklinks}-1]];
+               $more_backlinks=[@backlinks[$config{numbacklinks}..$#backlinks]];
+       }
 
        $template->param(
                title => $page eq 'index' 
@@ -116,7 +128,7 @@ sub genpage ($$$) { #{{{
                content => $content,
                backlinks => $backlinks,
                more_backlinks => $more_backlinks,
-               mtime => displaytime($mtime),
+               mtime => displaytime($pagemtime{$page}),
                baseurl => baseurl($page),
        );
 
@@ -154,7 +166,7 @@ sub scan ($) { #{{{
 
                # Always needs to be done, since filters might add links
                # to the content.
-               $content=filter($page, $content);
+               $content=filter($page, $page, $content);
 
                my @links;
                while ($content =~ /(?<!\\)$config{wiki_link_regexp}/g) {
@@ -181,18 +193,19 @@ sub render ($) { #{{{
        my $type=pagetype($file);
        my $srcfile=srcfile($file);
        if (defined $type) {
-               my $content=readfile($srcfile);
                my $page=pagename($file);
                delete $depends{$page};
                will_render($page, htmlpage($page), 1);
                
-               $content=filter($page, $content);
-               $content=preprocess($page, $page, $content);
-               $content=linkify($page, $page, $content);
-               $content=htmlize($page, $type, $content);
+               my $content=htmlize($page, $type,
+                       linkify($page, $page,
+                       preprocess($page, $page,
+                       filter($page, $page,
+                       readfile($srcfile)))));
                
-               writefile(htmlpage($page), $config{destdir},
-                       genpage($page, $content, mtime($srcfile)));
+               my $output=htmlpage($page);
+               writefile($output, $config{destdir}, genpage($page, $content));
+               utime($pagemtime{$page}, $pagemtime{$page}, $config{destdir}."/".$output);
        }
        else {
                my $srcfd=readfile($srcfile, 1, 1);
@@ -218,6 +231,7 @@ sub render ($) { #{{{
                                }
                        }
                });
+               utime($pagemtime{$file}, $pagemtime{$file}, $config{destdir}."/".$file);
        }
 } #}}}
 
@@ -232,6 +246,17 @@ sub prune ($) { #{{{
 } #}}}
 
 sub refresh () { #{{{
+       # security check, avoid following symlinks in the srcdir path
+       my $test=$config{srcdir};
+       while (length $test) {
+               if (-l $test) {
+                       error("symlink found in srcdir path ($test)");
+               }
+               unless ($test=~s/\/+$//) {
+                       $test=dirname($test);
+               }
+       }
+
        # find existing pages
        my %exists;
        my @files;
@@ -257,34 +282,37 @@ sub refresh () { #{{{
                        }
                },
        }, $config{srcdir});
-       find({
-               no_chdir => 1,
-               wanted => sub {
-                       $_=decode_utf8($_);
-                       if (file_pruned($_, $config{underlaydir})) {
-                               $File::Find::prune=1;
-                       }
-                       elsif (! -d $_ && ! -l $_) {
-                               my ($f)=/$config{wiki_file_regexp}/; # untaint
-                               if (! defined $f) {
-                                       warn(sprintf(gettext("skipping bad filename %s"), $_)."\n");
+       foreach my $dir (@{$config{underlaydirs}}, $config{underlaydir}) {
+               find({
+                       no_chdir => 1,
+                       wanted => sub {
+                               $_=decode_utf8($_);
+                               if (file_pruned($_, $dir)) {
+                                       $File::Find::prune=1;
                                }
-                               else {
-                                       # Don't add pages that are in the
-                                       # srcdir.
-                                       $f=~s/^\Q$config{underlaydir}\E\/?//;
-                                       if (! -e "$config{srcdir}/$f" && 
-                                           ! -l "$config{srcdir}/$f") {
-                                               my $page=pagename($f);
-                                               if (! $exists{$page}) {
-                                                       push @files, $f;
-                                                       $exists{$page}=1;
+                               elsif (! -d $_ && ! -l $_) {
+                                       my ($f)=/$config{wiki_file_regexp}/; # untaint
+                                       if (! defined $f) {
+                                               warn(sprintf(gettext("skipping bad filename %s"), $_)."\n");
+                                       }
+                                       else {
+                                               $f=~s/^\Q$dir\E\/?//;
+                                               # avoid underlaydir
+                                               # override attacks; see
+                                               # security.mdwn
+                                               if (! -e "$config{srcdir}/$f" && 
+                                                   ! -l "$config{srcdir}/$f") {
+                                                       my $page=pagename($f);
+                                                       if (! $exists{$page}) {
+                                                               push @files, $f;
+                                                               $exists{$page}=1;
+                                                       }
                                                }
                                        }
                                }
-                       }
-               },
-       }, $config{underlaydir});
+                       },
+               }, $dir);
+       };
 
        my %rendered;
 
@@ -315,6 +343,11 @@ sub refresh () { #{{{
                        prune($config{destdir}."/".$_)
                                foreach @{$oldrenderedfiles{$page}};
                        delete $pagesources{$page};
+                       foreach (keys %destsources) {
+                               if ($destsources{$_} eq $page) {
+                                       delete $destsources{$_};
+                               }
+                       }
                }
        }
 
@@ -333,7 +366,7 @@ sub refresh () { #{{{
        }
        run_hooks(needsbuild => sub { shift->(\@needsbuild) });
 
-       # scan and rendder files
+       # scan and render files
        foreach my $file (@needsbuild) {
                debug(sprintf(gettext("scanning %s"), $file));
                scan($file);
@@ -449,12 +482,13 @@ sub commandline_render () { #{{{
        my $content=readfile($srcfile);
        my $page=pagename($file);
        $pagesources{$page}=$file;
-       $content=filter($page, $content);
+       $content=filter($page, $page, $content);
        $content=preprocess($page, $page, $content);
        $content=linkify($page, $page, $content);
        $content=htmlize($page, $type, $content);
+       $pagemtime{$page}=mtime($srcfile);
 
-       print genpage($page, $content, mtime($srcfile));
+       print genpage($page, $content);
        exit 0;
 } #}}}