| Commit message (Collapse) | Author | Age |
|---|
| ... | |
| |
|
|
|
|
| |
The intention here seems to be that $prev may be undefined, and the
only way that can legitimately happen is for $params{token} to be
undefined too.
|
| |
|
|
| |
Sort in lexical order the pages that have the same number of hits.
|
| |
|
|
|
|
|
|
|
|
|
|
| |
Otherwise, we have an authorization bypass vulnerability: rcs_preprevert
looks at what changed in the commit we are reverting, not at what would
result from reverting it now. In particular, if some files were renamed
since the commit we are reverting, a revert of changes that were within
the designated subdirectory and allowed by check_canchange() might now
affect files that are outside the designated subdirectory or disallowed
by check_canchange().
Signed-off-by: Simon McVittie <smcv@debian.org>
|
| |
|
|
| |
Signed-off-by: Simon McVittie <smcv@debian.org>
|
| |
|
|
| |
with an empty title.
|
| | |
|
| |
|
|
|
|
|
| |
Otherwise, recent git releases show renames as renames, and we do not
see that newdir/test5 was affected.
Bug-Debian: https://bugs.debian.org/835612
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
Otherwise, if third-party plugins extend newenviron by more than
3 entries, we could overflow the array. It seems unlikely that any
third-party plugin manipulates newenviron in practice, so this
is mostly theoretical. Just in case, I have deliberately avoided
using "i" as the variable name, so that any third-party plugin
that was manipulating newenviron directly will now result in the
wrapper failing to compile.
I have not assumed that realloc(NULL, ...) works as an equivalent of
malloc(...), in case there are still operating systems where that
doesn't work.
|
| | |
|
| | |
|
| |
|
|
|
| |
[[plugins/contrib]] uses show=-1 to show the post-creation widget
without actually inlining anything.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
passing the SVG through to the browser
SVG scaling by img directives has subtly changed; where before size=wxh
would preserve aspect ratio, this cannot be done when passing them through
and so specifying both a width and height can change the SVG's aspect
ratio.
(This patch looks significantly more complex than it was, because a large
block of code had to be indented.)
[smcv: drop trailing whitespace, fix some spelling]
|
| |
|
|
|
| |
This mitigates CVE-2016-3714 and similar vulnerabilities by
avoiding passing obviously-wrong input to ImageMagick decoders.
|
| |
|
|
|
|
| |
This mitigates CVE-2016-3714. Wiki administrators who know that they
have prevented arbitrary code execution via other formats can re-enable
the other formats if desired.
|
| |
|
|
|
|
|
|
| |
A site administrator might unwisely set allowed_attachments to
something like '*.jpg or *.png'; if they do, an attacker could attach,
for example, a SVG file named attachment.jpg.
This mitigates CVE-2016-3714.
|
| |
|
|
|
|
|
|
|
|
|
|
| |
The instance in cgierror() is a potential cross-site scripting attack,
because an attacker could conceivably cause some module to raise an
exception that includes attacker-supplied HTML in its message, for
example via a crafted filename. (OVE-20160505-0012)
The instances in preprocess() is just correctness. It is not a
cross-site scripting attack, because an attacker could equally well
write the desired HTML themselves; the sanitize hook is what
protects us from cross-site scripting here.
|
| | |
|
| | |
|
| |
|
|
| |
is not, avoid showing a "Other" box which opens an empty form.
|
| | |
|
| |
|
|
|
|
|
| |
If the relative link from the (page generating the) RSS to the target
would start with "./" or "../", just concatenating it with the URL to
the directory containing the RSS is not sufficient. Go via
URI::new_abs to fix this.
|
| |
|
|
|
|
|
|
| |
Now I'm going to get bug reports about wanting the URLs to be
protocol-relative, but we can't win there as long as we generate RSS,
because RSS doesn't have well-defined semantics for relative URLs
(and the W3C's validator complains about them). If absolute URLs are
a problem for you, please use Atom feeds.
|
| |
|
|
| |
of modules' APIs
|
| |\ |
|
| | | |
|
| | | |
|
| | | |
|
| |\| |
|
| | |
| |
| |
| |
| |
| |
| | |
The old name still works, if its value is numeric.
This name allows a non-numeric "show" to mean the same thing
it does for [[!map]] (show title, show description, etc.).
|
| | | |
|
| | |
| |
| |
| |
| | |
This makes it harder to test, and if we're invoking git anyway,
a couple of extra subprocesses are no big deal.
|
| | |
| |
| |
| |
| |
| |
| | |
in .git/config
This resolves commit errors in versions of git that require a non-trivial
committer identity.
|
| | | |
|
| | | |
|
| | |
| |
| |
| |
| |
| | |
Specifically:
"Unescaped left brace in regex is deprecated, passed through in regex"
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
$im->Read() takes a filename-like argument with several sets of special
syntax. Most of the possible metacharacters are escaped by the
default `wiki_file_chars` (and in any case not particularly disruptive),
but the colon ":" is not.
It seems the way to force ImageMagick to treat colons within the
filename as literal is to prepend a colon, so do that.
|
| | | |
|
| | | |
|
| | | |
|
| | |
| |
| |
| | |
link text is identical
|
| | |
| |
| |
| | |
reproducibility
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
When building ikiwiki from a tarball, the mtime (conceptually, the
last modification date of the file) is preserved by tar, but the inode
change time (creation/metadata-change date of *this copy* of the file)
is not. This seems to lead to unstable sort ordering and
unreproducible builds.
The page can't possibly have been modified before it was created, so
we can assume that the modification date is an upper bound for the
creation date.
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
phase ends
This doesn't prevent memory from being used to track what we have
and haven't scanned, but it does make it temporary.
This only applies to rebuilds, as a way to avoid breaking the
templatebody plugin, unlike the earlier version of this optimization.
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
This reverts commit c04a26f3e70d654ccec5542daf8425e44cb5bac8, which
turns out to break the templatebody directive: readtemplate() relies
on scan() populating %templates, but if scan() is a no-op after
leaving the scan phase, we can't rely on that.
The assumption made by skipping scan() after the end of the render phase
is that everything that comes from a scan is already in the index.
However, we don't really want to put template bodies in the index:
that would force us to load and save them on every refresh, and
redundantly persist them to disk.
Test-case:
% make clean
% ./Makefile.PL
% make
% grep -E '<div class="notebox">|Use this template to' html/sandbox.html
% touch doc/sandbox/New_blog_entry.mdwn # sandbox inlines this
% make
% grep -E '<div class="notebox">|Use this template to' html/sandbox.html
Good result: html/sandbox.html contains <div class="notebox"> both times
Bad result: html/sandbox.html contains "Use this template to..." the
second time
|
| | |
| |
| |
| | |
for #786587 in libcgi-pm-perl)
|
| | |
| |
| |
| |
| |
| |
| | |
This avoids nasty surprises on upgrade if a site is using httpauth,
or passwordauth with an account_creation_password, and relying on
only a select group of users being able to edit the site. We can revisit
this for ikiwiki 4.
|
| | | |
|
| | | |
|
| | |
| |
| |
| |
| | |
The wikiname can be pretty un-helpful, the user will probably regognise the
url since they were just at it.
|