aboutsummaryrefslogtreecommitdiff
path: root/IkiWiki
Commit message (Collapse)AuthorAge
* Force CGI::FormBuilder->field to scalar context where necessarySimon McVittie2016-12-28
| | | | | | | | | | | | | | | | | | | | | | | | | | CGI::FormBuilder->field has behaviour similar to the CGI.pm misfeature we avoided in f4ec7b0. Force it into scalar context where it is used in an argument list. This prevents two (relatively minor) commit metadata forgery vulnerabilities: * In the comments plugin, an attacker who was able to post a comment could give it a user-specified author and author-URL even if the wiki configuration did not allow for that, by crafting multiple values to other fields. * In the editpage plugin, an attacker who was able to edit a page could potentially forge commit authorship by crafting multiple values for the rcsinfo field. The remaining plugins changed in this commit appear to have been protected by use of explicit scalar prototypes for the called functions, but have been changed anyway to make them more obviously correct. In particular, checkpassword() in passwordauth has a known prototype, so an attacker cannot trick it into treating multiple values of the name field as being the username, password and field to check for. OVE-20161226-0001
* git: do not fail to commit if committer is anonymousSimon McVittie2016-12-28
|
* git: don't issue a warning if rcsinfo is undefinedSimon McVittie2016-12-28
| | | | | | The intention here seems to be that $prev may be undefined, and the only way that can legitimately happen is for $params{token} to be undefined too.
* Make pagestats output more deterministic.intrigeri2016-12-19
| | | | Sort in lexical order the pages that have the same number of hits.
* Tell `git revert` not to follow renamesSimon McVittie2016-12-19
| | | | | | | | | | | | Otherwise, we have an authorization bypass vulnerability: rcs_preprevert looks at what changed in the commit we are reverting, not at what would result from reverting it now. In particular, if some files were renamed since the commit we are reverting, a revert of changes that were within the designated subdirectory and allowed by check_canchange() might now affect files that are outside the designated subdirectory or disallowed by check_canchange(). Signed-off-by: Simon McVittie <smcv@debian.org>
* cgitemplate: actually remove dead codeSimon McVittie2016-12-19
| | | | Signed-off-by: Simon McVittie <smcv@debian.org>
* inline: Prevent creating a file named ".mdwn" when the postform is submitted ↵Joey Hess2016-09-21
| | | | with an empty title.
* Update my surname to its new legal spelling.Amitai Schlair2016-09-14
|
* Use git log --no-renames for recentchangesSimon McVittie2016-09-03
| | | | | | | Otherwise, recent git releases show renames as renames, and we do not see that newdir/test5 was affected. Bug-Debian: https://bugs.debian.org/835612
* improve warning message for multiple sources for pageJoey Hess2016-05-31
|
* Wrapper: allocate new environment dynamicallySimon McVittie2016-05-11
| | | | | | | | | | | | | | Otherwise, if third-party plugins extend newenviron by more than 3 entries, we could overflow the array. It seems unlikely that any third-party plugin manipulates newenviron in practice, so this is mostly theoretical. Just in case, I have deliberately avoided using "i" as the variable name, so that any third-party plugin that was manipulating newenviron directly will now result in the wrapper failing to compile. I have not assumed that realloc(NULL, ...) works as an equivalent of malloc(...), in case there are still operating systems where that doesn't work.
* Detect image type from .JPG just like .jpg (etc.).Amitai Schlair2016-05-08
|
* img: make img_allowed_formats case-insensitiveSimon McVittie2016-05-07
|
* inline: expand show=N backwards compatibility to negative NSimon McVittie2016-05-06
| | | | | [[plugins/contrib]] uses show=-1 to show the post-creation widget without actually inlining anything.
* img: Add back support for SVG images, bypassing ImageMagick and simply ↵Simon McVittie2016-05-06
| | | | | | | | | | | | | | passing the SVG through to the browser SVG scaling by img directives has subtly changed; where before size=wxh would preserve aspect ratio, this cannot be done when passing them through and so specifying both a width and height can change the SVG's aspect ratio. (This patch looks significantly more complex than it was, because a large block of code had to be indented.) [smcv: drop trailing whitespace, fix some spelling]
* img: check magic number before giving common formats to ImageMagickSimon McVittie2016-05-05
| | | | | This mitigates CVE-2016-3714 and similar vulnerabilities by avoiding passing obviously-wrong input to ImageMagick decoders.
* img: restrict to JPEG, PNG and GIF images by defaultSimon McVittie2016-05-05
| | | | | | This mitigates CVE-2016-3714. Wiki administrators who know that they have prevented arbitrary code execution via other formats can re-enable the other formats if desired.
* img: force common Web formats to be interpreted according to extensionSimon McVittie2016-05-05
| | | | | | | | A site administrator might unwisely set allowed_attachments to something like '*.jpg or *.png'; if they do, an attacker could attach, for example, a SVG file named attachment.jpg. This mitigates CVE-2016-3714.
* HTML-escape error messages (OVE-20160505-0012)Simon McVittie2016-05-05
| | | | | | | | | | | | The instance in cgierror() is a potential cross-site scripting attack, because an attacker could conceivably cause some module to raise an exception that includes attacker-supplied HTML in its message, for example via a crafted filename. (OVE-20160505-0012) The instances in preprocess() is just correctness. It is not a cross-site scripting attack, because an attacker could equally well write the desired HTML themselves; the sanitize hook is what protects us from cross-site scripting here.
* Correctly handle filenames starting with a dash in add/rm/mv.Florian Wagner2016-03-17
|
* Process .md like .mdwn, but disallow web creation.Amitai Schlair2016-03-08
|
* loginselector: When only openid and emailauth are enabled, but passwordauth ↵Joey Hess2016-03-02
| | | | is not, avoid showing a "Other" box which opens an empty form.
* Fix typo.Amitai Schlair2016-02-20
|
* Compose relative URLs in RSS feeds correctlySimon McVittie2016-01-21
| | | | | | | If the relative link from the (page generating the) RSS to the target would start with "./" or "../", just concatenating it with the URL to the directory containing the RSS is not sufficient. Go via URI::new_abs to fix this.
* Force comments URL in RSS feeds to be absoluteSimon McVittie2016-01-21
| | | | | | | | Now I'm going to get bug reports about wanting the URLs to be protocol-relative, but we can't win there as long as we generate RSS, because RSS doesn't have well-defined semantics for relative URLs (and the W3C's validator complains about them). If absolute URLs are a problem for you, please use Atom feeds.
* Silence "used only once: possible typo" warnings for variables that are part ↵Simon McVittie2016-01-19
| | | | of modules' APIs
* Merge remote-tracking branch 'smcv/pagestats-show'Simon McVittie2015-11-30
|\
| * pagestats: rename disp to show, and document itSimon McVittie2014-09-14
| |
| * pagestats: consistent indentationSimon McVittie2014-09-14
| |
| * pagestats: add disp parameterLouis2014-09-14
| |
* | Merge remote-tracking branch 'smcv/ready/limit'Simon McVittie2015-11-30
|\|
| * Rename show parameter of [[!inline]] and [[!pagestats]] to limitSimon McVittie2014-09-14
| | | | | | | | | | | | | | The old name still works, if its value is numeric. This name allows a non-numeric "show" to mean the same thing it does for [[!map]] (show title, show description, etc.).
* | ensure_committer: don't do anything if we have the environment variablesSimon McVittie2015-11-30
| |
* | Don't memoize ensure_committerSimon McVittie2015-11-30
| | | | | | | | | | This makes it harder to test, and if we're invoking git anyway, a couple of extra subprocesses are no big deal.
* | git: if no committer identity is known, set it to "IkiWiki <ikiwiki.info>" ↵Simon McVittie2015-11-30
| | | | | | | | | | | | | | in .git/config This resolves commit errors in versions of git that require a non-trivial committer identity.
* | emailauth: Added emailauth_sender config.Joey Hess2015-10-02
| |
* | Fix [[!meta name=foo]] by closing the open quote.Amitai Schlair2015-08-22
| |
* | Squelch regex deprecation warnings from Perl 5.22.Amitai Schlair2015-06-14
| | | | | | | | | | | | Specifically: "Unescaped left brace in regex is deprecated, passed through in regex"
* | img: stop ImageMagick trying to be clever if filenames contain a colonSimon McVittie2015-06-13
| | | | | | | | | | | | | | | | | | | | $im->Read() takes a filename-like argument with several sets of special syntax. Most of the possible metacharacters are escaped by the default `wiki_file_chars` (and in any case not particularly disruptive), but the colon ":" is not. It seems the way to force ImageMagick to treat colons within the filename as literal is to prepend a colon, so do that.
* | inline: change default sort order from age to "age title" for determinismSimon McVittie2015-06-13
| |
* | polygen: if deterministic build is requested, use a well-known random seedSimon McVittie2015-06-09
| |
* | haiku: if deterministic build is requested, return a hard-coded haikuSimon McVittie2015-06-09
| |
* | Sort backlinks deterministically, by falling back to sorting by href if the ↵Simon McVittie2015-06-09
| | | | | | | | link text is identical
* | brokenlinks: sort the pages that link to the missing page, for better ↵Simon McVittie2015-06-09
| | | | | | | | reproducibility
* | Populate pagectime from mtime or inode change time, whichever is olderSimon McVittie2015-06-09
| | | | | | | | | | | | | | | | | | | | | | | | When building ikiwiki from a tarball, the mtime (conceptually, the last modification date of the file) is preserved by tar, but the inode change time (creation/metadata-change date of *this copy* of the file) is not. This seems to lead to unstable sort ordering and unreproducible builds. The page can't possibly have been modified before it was created, so we can assume that the modification date is an upper bound for the creation date.
* | In rebuilds, assume that every page has been scanned by the time the scan ↵Simon McVittie2015-06-09
| | | | | | | | | | | | | | | | | | | | phase ends This doesn't prevent memory from being used to track what we have and haven't scanned, but it does make it temporary. This only applies to rebuilds, as a way to avoid breaking the templatebody plugin, unlike the earlier version of this optimization.
* | Revert "Assume that every page has been scanned by the time the scan phase ends"Simon McVittie2015-06-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit c04a26f3e70d654ccec5542daf8425e44cb5bac8, which turns out to break the templatebody directive: readtemplate() relies on scan() populating %templates, but if scan() is a no-op after leaving the scan phase, we can't rely on that. The assumption made by skipping scan() after the end of the render phase is that everything that comes from a scan is already in the index. However, we don't really want to put template bodies in the index: that would force us to load and save them on every refresh, and redundantly persist them to disk. Test-case: % make clean % ./Makefile.PL % make % grep -E '<div class="notebox">|Use this template to' html/sandbox.html % touch doc/sandbox/New_blog_entry.mdwn # sandbox inlines this % make % grep -E '<div class="notebox">|Use this template to' html/sandbox.html Good result: html/sandbox.html contains <div class="notebox"> both times Bad result: html/sandbox.html contains "Use this template to..." the second time
* | Make the attachment plugin work with CGI.pm 4.x (Closes: #786586; workaround ↵Simon McVittie2015-06-07
| | | | | | | | for #786587 in libcgi-pm-perl)
* | Do not directly enable emailauth by default, only indirectly via openidSimon McVittie2015-05-27
| | | | | | | | | | | | | | This avoids nasty surprises on upgrade if a site is using httpauth, or passwordauth with an account_creation_password, and relying on only a select group of users being able to edit the site. We can revisit this for ikiwiki 4.
* | sohrten url in subjectJoey Hess2015-05-19
| |
generated by cgit v1.2.3 (git 2.25.4) at 2024-11-01 04:29:49 +0000