Commit Graph

2684 Commits (0b4981588e6e7e5c49219fa534482f789dc14dad)

Author SHA1 Message Date
Simon McVittie 469c842fd5 Revert "Tell `git revert` not to follow renames"
This doesn't work prior to git 2.8: `git revert` silently ignores the
option and succeeds. We will have to fix CVE-2016-10026 some other way.

This reverts commit 9cada49ed6.
2016-12-28 21:32:12 +00:00
Simon McVittie c1120bbbe8 Force CGI::FormBuilder->field to scalar context where necessary
CGI::FormBuilder->field has behaviour similar to the CGI.pm misfeature
we avoided in f4ec7b0. Force it into scalar context where it is used
in an argument list.

This prevents two (relatively minor) commit metadata forgery
vulnerabilities:

* In the comments plugin, an attacker who was able to post a comment
  could give it a user-specified author and author-URL even if the wiki
  configuration did not allow for that, by crafting multiple values
  to other fields.
* In the editpage plugin, an attacker who was able to edit a page
  could potentially forge commit authorship by crafting multiple values
  for the rcsinfo field.

The remaining plugins changed in this commit appear to have been
protected by use of explicit scalar prototypes for the called functions,
but have been changed anyway to make them more obviously correct.
In particular, checkpassword() in passwordauth has a known prototype,
so an attacker cannot trick it into treating multiple values of the
name field as being the username, password and field to check for.

OVE-20161226-0001
2016-12-28 21:32:12 +00:00
Simon McVittie e193c75b7d git: do not fail to commit if committer is anonymous 2016-12-28 21:32:12 +00:00
Simon McVittie a67f4d3944 git: don't issue a warning if rcsinfo is undefined
The intention here seems to be that $prev may be undefined, and the
only way that can legitimately happen is for $params{token} to be
undefined too.
2016-12-28 21:32:12 +00:00
intrigeri c1890c116d Make pagestats output more deterministic.
Sort in lexical order the pages that have the same number of hits.
2016-12-19 18:21:07 +00:00
Simon McVittie 9cada49ed6 Tell `git revert` not to follow renames
Otherwise, we have an authorization bypass vulnerability: rcs_preprevert
looks at what changed in the commit we are reverting, not at what would
result from reverting it now. In particular, if some files were renamed
since the commit we are reverting, a revert of changes that were within
the designated subdirectory and allowed by check_canchange() might now
affect files that are outside the designated subdirectory or disallowed
by check_canchange().

Signed-off-by: Simon McVittie <smcv@debian.org>
2016-12-19 18:21:07 +00:00
Joey Hess 68e2320696
inline: Prevent creating a file named ".mdwn" when the postform is submitted with an empty title. 2016-09-21 13:51:42 -04:00
Amitai Schlair 85c10d149b Update my surname to its new legal spelling. 2016-09-14 14:28:01 -04:00
Simon McVittie 276f0cf578 Use git log --no-renames for recentchanges
Otherwise, recent git releases show renames as renames, and we do not
see that newdir/test5 was affected.

Bug-Debian: https://bugs.debian.org/835612
2016-09-03 23:47:06 +01:00
Amitai Schlair 89af9ecc57 Detect image type from .JPG just like .jpg (etc.). 2016-05-08 18:31:02 -04:00
Simon McVittie 47b180e35f img: make img_allowed_formats case-insensitive 2016-05-07 23:22:52 +01:00
Simon McVittie 125461cab7 inline: expand show=N backwards compatibility to negative N
[[plugins/contrib]] uses show=-1 to show the post-creation widget
without actually inlining anything.
2016-05-06 22:51:02 +01:00
Simon McVittie 984ba82f1b img: Add back support for SVG images, bypassing ImageMagick and simply passing the SVG through to the browser
SVG scaling by img directives has subtly changed; where before size=wxh
would preserve aspect ratio, this cannot be done when passing them through
and so specifying both a width and height can change the SVG's aspect
ratio.

(This patch looks significantly more complex than it was, because a large
block of code had to be indented.)

[smcv: drop trailing whitespace, fix some spelling]
2016-05-06 06:57:12 +01:00
Simon McVittie 170cd41489 img: check magic number before giving common formats to ImageMagick
This mitigates CVE-2016-3714 and similar vulnerabilities by
avoiding passing obviously-wrong input to ImageMagick decoders.
2016-05-05 23:43:50 +01:00
Simon McVittie 545a7bbbf0 img: restrict to JPEG, PNG and GIF images by default
This mitigates CVE-2016-3714. Wiki administrators who know that they
have prevented arbitrary code execution via other formats can re-enable
the other formats if desired.
2016-05-05 23:43:50 +01:00
Simon McVittie 54a9f8d07d img: force common Web formats to be interpreted according to extension
A site administrator might unwisely set allowed_attachments to
something like '*.jpg or *.png'; if they do, an attacker could attach,
for example, a SVG file named attachment.jpg.

This mitigates CVE-2016-3714.
2016-05-05 23:43:50 +01:00
Florian Wagner bbdba8d770
Correctly handle filenames starting with a dash in add/rm/mv. 2016-03-17 11:01:27 -04:00
Amitai Schlair 63fa0ef5ba Process .md like .mdwn, but disallow web creation. 2016-03-08 14:31:15 -05:00
Joey Hess 8d28f70b37
loginselector: When only openid and emailauth are enabled, but passwordauth is not, avoid showing a "Other" box which opens an empty form. 2016-03-02 16:35:16 -04:00
Amitai Schlair f93544db76 Fix typo. 2016-02-20 22:00:54 -05:00
Simon McVittie 7aca0d40a3 Compose relative URLs in RSS feeds correctly
If the relative link from the (page generating the) RSS to the target
would start with "./" or "../", just concatenating it with the URL to
the directory containing the RSS is not sufficient. Go via
URI::new_abs to fix this.
2016-01-21 08:40:14 +00:00
Simon McVittie 855b757f37 Force comments URL in RSS feeds to be absolute
Now I'm going to get bug reports about wanting the URLs to be
protocol-relative, but we can't win there as long as we generate RSS,
because RSS doesn't have well-defined semantics for relative URLs
(and the W3C's validator complains about them). If absolute URLs are
a problem for you, please use Atom feeds.
2016-01-21 07:50:13 +00:00
Simon McVittie 317d19842c Silence "used only once: possible typo" warnings for variables that are part of modules' APIs 2016-01-19 11:24:18 +00:00
Simon McVittie 72c3b81efb Merge remote-tracking branch 'smcv/pagestats-show' 2015-11-30 20:58:54 +00:00
Simon McVittie b199349ffd Merge remote-tracking branch 'smcv/ready/limit' 2015-11-30 20:55:34 +00:00
Simon McVittie 1f635c6dca ensure_committer: don't do anything if we have the environment variables 2015-11-30 20:46:58 +00:00
Simon McVittie 8550c39701 Don't memoize ensure_committer
This makes it harder to test, and if we're invoking git anyway,
a couple of extra subprocesses are no big deal.
2015-11-30 20:46:58 +00:00
Simon McVittie ed1e1ebe70 git: if no committer identity is known, set it to "IkiWiki <ikiwiki.info>" in .git/config
This resolves commit errors in versions of git that require a non-trivial
committer identity.
2015-11-30 19:34:04 +00:00
Joey Hess 32923e732b emailauth: Added emailauth_sender config. 2015-10-02 11:49:47 -04:00
Amitai Schlair 09916a90ed Fix [[!meta name=foo]] by closing the open quote. 2015-08-22 22:34:53 -04:00
Amitai Schlair 604d0391ba Squelch regex deprecation warnings from Perl 5.22.
Specifically:

"Unescaped left brace in regex is deprecated, passed through in regex"
2015-06-14 21:35:51 -04:00
Simon McVittie 7a2117bf8c img: stop ImageMagick trying to be clever if filenames contain a colon
$im->Read() takes a filename-like argument with several sets of special
syntax. Most of the possible metacharacters are escaped by the
default `wiki_file_chars` (and in any case not particularly disruptive),
but the colon ":" is not.

It seems the way to force ImageMagick to treat colons within the
filename as literal is to prepend a colon, so do that.
2015-06-13 20:00:08 +01:00
Simon McVittie f2365c3e66 inline: change default sort order from age to "age title" for determinism 2015-06-13 19:58:37 +01:00
Simon McVittie 014b9eb1b7 polygen: if deterministic build is requested, use a well-known random seed 2015-06-09 22:30:44 +01:00
Simon McVittie 361076e55d haiku: if deterministic build is requested, return a hard-coded haiku 2015-06-09 22:30:43 +01:00
Simon McVittie 8e007666d4 brokenlinks: sort the pages that link to the missing page, for better reproducibility 2015-06-09 22:28:31 +01:00
Simon McVittie 7a52c87a8c Make the attachment plugin work with CGI.pm 4.x (Closes: #786586; workaround for #786587 in libcgi-pm-perl) 2015-06-07 14:51:13 +01:00
Simon McVittie 2afb0dd663 Do not directly enable emailauth by default, only indirectly via openid
This avoids nasty surprises on upgrade if a site is using httpauth,
or passwordauth with an account_creation_password, and relying on
only a select group of users being able to edit the site. We can revisit
this for ikiwiki 4.
2015-05-27 08:52:01 +01:00
Joey Hess 3676ab329d sohrten url in subject 2015-05-19 17:44:20 -04:00
Joey Hess ba02e7f33d nicer layout of subject 2015-05-19 17:41:14 -04:00
Joey Hess 73e32f7fa6 add url to subject of email
The wikiname can be pretty un-helpful, the user will probably regognise the
url since they were just at it.
2015-05-19 17:38:15 -04:00
Joey Hess ab1bba9dab cloak user PII when making commits etc, and let cloaked PII be used in banned_users
This was needed due to emailauth, but I've also wrapped all IP address
exposure in cloak(), although the function doesn't yet cloak IP addresses.

(One IP address I didn't cloak is the one that appears on the password
reset email template. That is expected to be the user's own IP address,
so ok to show it to them.)

Thanks to smcv for the pointer to
http://xmlns.com/foaf/spec/#term_mbox_sha1sum
2015-05-14 11:58:21 -04:00
Joey Hess 85a529db3d passwordauth: Don't allow registering accounts that look like openids.
Also prohibit @ in account names, in case the file regexp was relaxed to
allow it.
2015-05-14 10:57:56 -04:00
Joey Hess 70cf5bb765 don't let emailauth user's email address be changed on preferences page
There's no real problem if they do change it, except they may get confused
and expect to be able to log in with the changed email and get the same
user account.
2015-05-13 23:32:29 -04:00
Joey Hess 7a68c4a01c when an emailauth user posts a comment, use the username only, not the full email address
This makes the email not be displayed on the wiki, so spammers won't find
it there.

Note that the full email address is still put into the comment template.
The email is also used as the username of the git commit message
(when posting comments or page edits). May want to revisit this later.
2015-05-13 23:26:22 -04:00
Joey Hess 497513e737 avoid showing password prefs for emailauth user 2015-05-13 23:24:07 -04:00
Joey Hess a7bd24b7b9 fix up session cookie 2015-05-13 23:06:52 -04:00
Joey Hess 95e1e51caa emailauth link sent and verified; user login works
Still some work to do since the user name is an email address and should
not be leaked.
2015-05-13 22:27:03 -04:00
Joey Hess 035c1a2449 move stub auth hook to loginselector 2015-05-13 18:54:13 -04:00
Joey Hess e34533d1a0 email auth plugin now works through email address entry 2015-05-13 18:50:40 -04:00
Joey Hess 5b459737a5 Converted openid-selector into a more generic loginselector helper plugin. 2015-05-13 18:50:29 -04:00
Joey Hess f8add0adb3 rename openid selector files to login-selector 2015-05-13 17:58:59 -04:00
Joey Hess 7765941011 further generalization of openid selector
Now template variables can be set to control which login methods are shown
2015-05-13 17:51:29 -04:00
Joey Hess ab4d9a5467 generalized the openid selector to a login selector
This includes some CSS changes to names of elements.

Also, added Email login button (doesn't work yet of course),
and brought back the small openid login buttons. Demoted yahoo and verison
to small buttons. This makes the big buttons be the main login types, and
the small buttons be provider-specific helpers.
2015-05-13 16:50:44 -04:00
Joey Hess ec72b4c95b When openid and passwordauth are the only enabled auth plugins, make the openid selector display "Password" instead of "Other", so users are more likely to click on it when they don't have an openid. 2015-05-13 12:18:22 -04:00
Simon McVittie a1fda0b516 Standardize on --long-option instead of -long-option
[[forum/refresh_and_setup]] indicates some confusion between --setup
and -setup. Both work, but it's clearer if we stick to one in
documentation and code.

A 2012 commit to [[plugins/theme]] claims that "-setup" is required
and "--setup" won't work, but I cannot find any evidence in ikiwiki's
source code that this has ever been the case.
2015-03-01 16:15:01 +00:00
Amitai Schlair 3a19663d48 In VCS-committed anonymous comments, link to url. 2015-01-08 08:11:40 -05:00
Amitai Schlair 0451dc4133 Update blogspam to the 2.0 API. 2015-01-02 13:55:10 -05:00
Joey Hess f88e109bec po: If msgmerge falls over on a problem po file, print a warning message, but don't let this problem crash ikiwiki entirely. 2014-12-30 15:51:50 -04:00
Amitai Schlair a87f43d71e Avoid uninitialized warnings with comments+no CGI. 2014-12-28 13:15:45 -05:00
Amitai Schlair 38a088a433 ikiwiki-comment: optionally override parameters. 2014-12-27 22:38:18 -05:00
Amitai Schlair b87e46a76d Squelch "keys on reference is experimental". 2014-12-27 16:55:12 -05:00
Simon McVittie 6c51b764bc Merge branch 'ready/html5' 2014-11-26 11:58:05 +00:00
Simon McVittie 1abf35e1b5 Fix numeric comparisons with undef 2014-11-26 11:29:14 +00:00
Simon McVittie 36f5e63d73 fix some typos 2014-11-26 09:23:24 +00:00
Simon McVittie 96566c33a7 Merge remote-tracking branch 'spalax/calendar-autocreate' 2014-11-26 09:13:44 +00:00
Louis 473bcbe7a4 Corrected error: month pages were created even without calendar_autocreate config option 2014-11-14 14:59:58 +01:00
Louis d0b3495124 Deleted unnecessary code 2014-11-14 12:52:51 +01:00
Louis 1d97160dae Indentation 2014-11-14 12:50:17 +01:00
Joey Hess ea8c7a7e02 openid: Stop suppressing the email field on the Preferences page.
This is needed for notifyemail, and not all openid providers report an
email address, or necessarily the one the user wants to get email.
2014-11-06 15:00:09 -04:00
Joey Hess 82a4fb49ae add ikiwiki-comment program 2014-10-20 12:08:07 -04:00
Amitai Schlair 305c91ccfb Remove space from perl shebang path. 2014-10-17 09:05:00 -04:00
Amitai Schlair 09e7c1ad99 IkiWiki::Plugin::openid: as a precaution, do not call non-coderefs
We're running under "use strict" here, so if CGI->param's array-context
misbehaviour passes an extra non-ref parameter, it shouldn't be executed
anyway... but it's as well to be safe.

[commit message added by smcv]
2014-10-16 22:24:48 +01:00
Amitai Schlair cfbcbda0ad Call CGI->param_fetch instead of CGI->param in array context
CGI->param has the misfeature that it is context-sensitive, and in
particular can expand to more than one scalar in function calls.
This led to a security vulnerability in Bugzilla, and recent versions
of CGI.pm will warn when it is used in this way.

In the situations where we do want to cope with more than one parameter
of the same name, CGI->param_fetch (which always returns an
array-reference) makes the intention clearer.

[commit message added by smcv]
2014-10-16 22:24:47 +01:00
Simon McVittie f4ec7b06d9 Make sure we do not pass multiple CGI parameters in function calls
When CGI->param is called in list context, such as in function
parameters, it expands to all the potentially multiple values
of the parameter: for instance, if we parse query string a=b&a=c&d=e
and call func($cgi->param('a')), that's equivalent to func('b', 'c').
Most of the functions we're calling do not expect that.

I do not believe this is an exploitable security vulnerability in
ikiwiki, but it was exploitable in Bugzilla.
2014-10-16 22:24:47 +01:00
Simon McVittie 490a1eca7b Always produce HTML5 doctype and new attributes, but not new elements
According to caniuse.com, a significant fraction of Web users are
still using Internet Explorer versions that do not support HTML5
sectioning elements. However, claiming we're XHTML 1.0 Strict
means we can't use features invented in the last 12 years, even if
they degrade gracefully in older browsers (like the role and placeholder
attributes).

This means our output is no longer valid according to any particular
DTD. Real browsers and other non-validator user-agents have never
cared about DTD compliance anyway, so I don't think this is a real loss.
2014-10-16 11:04:53 +01:00
Simon McVittie 17fccbca94 Do not pass ignored sid parameter to checksessionexpiry
checksessionexpiry's signature changed from
(CGI::Session, CGI->param('sid')) to (CGI, CGI::Session) in commit
985b229b, but editpage still passed the sid as a useless third
parameter, and this was later cargo-culted into remove, rename and
recentchanges.
2014-10-12 18:03:57 +01:00
Simon McVittie 4e2bfe1e17 comments: don't log remote IP address for signed-in users
The intention was that signed-in users (for instance via httpauth,
passwordauth or openid) are already adequately identified, but
there's nothing to indicate who an anonymous commenter is unless
their IP address is recorded.
2014-10-12 18:03:28 +01:00
Simon McVittie eb4945a3bc img: raise an error if we cannot find the image's size
This happens for PDFs without ghostscript installed, for instance.
2014-09-16 10:00:40 +01:00
Simon McVittie 7f5c2cfa5a Merge branch 'ready/templatebody' 2014-09-15 21:52:03 +01:00
Simon McVittie c1b80c54fa Merge branch 'ready/autoindex-more-often' 2014-09-15 21:23:18 +01:00
Simon McVittie ea2ab6f885 Merge branch 'ready/more-magic' 2014-09-15 21:08:40 +01:00
Simon McVittie e3e6ca2777 pagestats: rename disp to show, and document it 2014-09-14 15:57:09 +01:00
Simon McVittie 89492a62a7 pagestats: consistent indentation 2014-09-14 15:51:22 +01:00
Louis cd5a24d8b4 pagestats: add disp parameter 2014-09-14 15:49:38 +01:00
Simon McVittie ab768a62c6 Rename show parameter of [[!inline]] and [[!pagestats]] to limit
The old name still works, if its value is numeric.

This name allows a non-numeric "show" to mean the same thing
it does for [[!map]] (show title, show description, etc.).
2014-09-14 15:15:27 +01:00
Simon McVittie 9be3f95116 Merge branch 'ready/imgforpdf-and-more' 2014-09-12 21:59:00 +01:00
Simon McVittie 669a5f5ecc Merge branch 'ready/chrysn/linkmapenhancement' 2014-09-12 21:57:04 +01:00
Simon McVittie 390f12a845 Merge branch 'ready/edittemplate2' 2014-09-12 21:54:13 +01:00
Simon McVittie dadde570a1 Merge branch 'ready/postform-no' 2014-09-12 21:46:04 +01:00
Simon McVittie 252804628d Merge branch 'ready/perf' 2014-09-12 21:45:04 +01:00
Simon McVittie a55752a7be Merge branch 'ready/comments' 2014-09-12 21:40:24 +01:00
Simon McVittie 2eea320b67 Merge branch 'ready/trail-sort' 2014-09-12 21:38:06 +01:00
Simon McVittie 77a2267dcf filecheck: accept MIME types that don't contain ';' 2014-09-10 09:00:20 +01:00
Simon McVittie 26d62b386e edittemplate: use unambiguous RFC 3339 datestamps
These take into account the timezone offset (and convert it to UTC+0000)
rather than being in an unspecified timezone.
2014-09-01 09:01:07 +01:00
Simon McVittie 6806ddfdff Only provide time, not formatted_time, to edittemplate templates
I'm not sure what the use-case is for formatted_time, and chrysn
pointed out that for display in HTML, [[!date "<TMPL_VAR time>"]]
would be nicer.
2014-09-01 08:58:12 +01:00
Jonathon Anderson 9adee0a222 Provide the current time to edittemplate.
The `time` variable contains a fixed-format time, guaranteed suitable
for parsing by timedate.

The `formatted_time` variable contains the same time formatted by
IkiWiki::formattime.
2014-09-01 08:54:37 +01:00
Simon McVittie eb87dd177a Use Linux uuid facility instead of an external library if possible 2014-09-01 08:54:37 +01:00
Simon McVittie 4a11dc4d16 edittemplate: only generate a UUID on-demand
If the template doesn't use <TMPL_VAR UUID> there's no point in
incurring any cost.
2014-09-01 08:54:37 +01:00
Jonathon Anderson 7aa10a2952 Provide a UUID in edittemplate templates.
I want to make GUIDs for my RSS feeds that don't change when I move
pages around.  To that end, I've used UUID::Tiny to generate a
version 4 (random) UUID that is presented in a `uuid` variable in
the template.

At that point, you can do something like this:

    [[!meta guid="urn:uuid:<TMPL_VAR uuid>"]]
2014-09-01 08:54:37 +01:00