c6fc554c54
use quotemeta when building the regexp
2008-02-10 19:02:12 -05:00
728dfd9595
Allow the smb: URI scheme.
2008-02-10 15:08:56 -08:00
502cd00ec7
Allow the snews: URI scheme.
2008-02-10 15:05:11 -08:00
ec9d3ab549
Do not allow the steam: URI scheme.
2008-02-10 14:59:08 -08:00
3cda22a27f
Match literal '.' in URI schemas containing '.', rather than matching any character
2008-02-10 14:50:30 -08:00
bbcf878f75
* meta: Check that the urls provided for authorurl, permalink, and openid
...
are safe and can't contain javascript.
2008-02-10 17:17:44 -05:00
4bfdbd4858
export $safe_url_regexp
2008-02-10 17:07:21 -05:00
d20e24b636
Also filter the attributes cite, longdesc, and usemap, which can contain URIs
2008-02-10 13:59:37 -08:00
2078f706d6
add parens around scheme regexp
2008-02-10 16:29:46 -05:00
a7be7bdf56
Do not allow the about: URI scheme
...
Some browsers interpret about: URIs like a limited version of data:
URIs. In particular, some versions of Internet Explorer interpret
arbitrary HTML content in about: URIs.
2008-02-10 13:23:28 -08:00
dfd6bb3854
fix data:image handling
2008-02-10 15:24:03 -05:00
d7e0c035e5
* htmlscrubber security fix: Block javascript in uris.
...
* Add htmlscrubber test suite.
2008-02-10 13:16:40 -05:00
a4b2e77077
add support for prefix_directives
2008-02-05 16:14:38 -05:00
f64ef7deb6
proper fix for the preview/will_render issue
2008-02-04 18:46:34 -05:00
b37dc9c926
preview shouldn't show the feed buttons or post form
2008-02-04 18:44:54 -05:00
bf522a347f
* inline: Add new `allowrss` and `allowatom` config options. These can be
...
used if you want a wiki that doesn't default to generating rss or atom
feeds, but that does allow them to be turned on for specific blogs.
2008-02-04 18:36:50 -05:00
85de2f7bc4
the old code worked, suprisingly, but I prefer this form
2008-02-04 18:05:40 -05:00
d1c4899a22
* inline: When previewing, still call will_render on rss/atom files,
...
just avoid actually writing the files. This is necessary because ikiwiki
saves state after a preview (in case it actually *did* write files),
and if will_render isn't called its security checks will get upset
when the page is saved. Thanks to Edward Betts for his help tracking this
tricky bug down.
2008-02-04 17:58:23 -05:00
9d54cc4659
implement aggregate_locking design
...
Now aggregation will not lock the wiki. Any changes made during aggregaton are
merged in with the changed state accumulated while aggregating. A separate
lock file prevents multiple concurrent aggregators. Garbage collection
of orphaned guids is much improved. loadstate() is only called once
per process, so tricky support for reloading wiki state is not needed.
(Tested fairly thuroughly.)
2008-02-03 16:48:26 -05:00
38affb0c1c
add aggregate locking functions
2008-02-03 15:17:15 -05:00
e57749b702
* recentchanges: Exipre all *._change pages, even if the directory
...
they're in has changed.
2008-02-03 14:51:03 -05:00
340fe9707c
* recentchanges: Improve handling of links on the very static changes pages
...
by thunking to the CGI, which can redirect to the page, or allow it to be
created if it doesn't exist.
2008-02-03 14:48:20 -05:00
42e5b8dfdc
prototype fix
2008-02-03 14:22:25 -05:00
1f6591f0a6
* aggregate: Revert use of forking to not save state, that was not the right
...
approach.
2008-02-03 03:04:19 -05:00
9f60272831
* poll: This plugin turns out to have edited pages w/o doing any locking.
...
Oops. Convert it from a cgi to a sessioncgi hook, which will work
much better.
2008-02-03 00:26:00 -05:00
0779013683
* aggregate: Forking a child broke the one state that mattered: Forcing
...
the aggregating page to be rebuilt. Fix this.
2008-02-02 23:56:13 -05:00
870adf3bbf
move openiduser function to the openid plugin
2008-01-30 02:39:17 -05:00
55e16be44a
move recentchanges link enabling into a pagetemplate hook
2008-01-30 02:29:12 -05:00
f584abec0c
really fix the baseurl problem
...
the issue is that HTML::Template doesn't expand top-level variables when inside
a loop
2008-01-29 18:19:47 -05:00
3803266b8f
merged the recentchanges branch
...
misc fixes
2008-01-29 17:50:11 -05:00
7a40bcab9a
add missing test to avoid uninitialised value when a page with metadata is removed
2008-01-29 17:36:25 -05:00
64a8c828b8
* meta: Add pagespec functions to match against title, author, authorurl,
...
license, and copyright. This can be used to create custom RecentChanges.
* meta: To support the pagespec functions, metadata about pages has to be
retained as pagestate.
* Fix encoding bug when pagestate values contained spaces.
2008-01-29 17:16:51 -05:00
bc49e284ac
make the author metadata for changes pages be the un-munged openid
2008-01-29 16:05:31 -05:00
8b31c53366
added configuration for recentchanges
...
I kept it to a simple global configuration, rather than using the
preprocessor directive for recentchanges, because that had chicken and egg
problems and seemed overcomplicated. This should work reasonably well,
though it would be good to add some more metadata so that more customised
recentchanges pages can be made.
2008-01-29 15:51:32 -05:00
cabd5140c4
add code to delete old change pages
2008-01-29 15:22:23 -05:00
35bc35660c
use new refresh hook
2008-01-29 13:08:48 -05:00
a5ad70a8dc
updates
2008-01-29 12:59:49 -05:00
598d338b11
escape wikilinks and preprocessor directives
2008-01-29 12:37:39 -05:00
85eb1abc61
typo
2008-01-29 04:45:54 -05:00
38e79f206e
more style improvements
2008-01-29 04:44:05 -05:00
21f44880cd
non-tabular recentchanges display
...
Doesn't look as good as the old table, but works as a rss feed.
2008-01-29 01:48:55 -05:00
d2a3695376
some parameteraisation and generalisation
2008-01-29 01:03:15 -05:00
5921b86fcc
proof of concept implementation of static recentchanges
...
Currently hardcoded to write to recentchanges/*, and the page format needs
to be rethought to be usable for aggregation, but it basically works.
2008-01-28 23:56:26 -05:00
2d3dc86d07
* prettydate,ddate: Don't ignore time formats passed to displaytime
...
function.
2008-01-28 23:48:27 -05:00
3436fed081
* inline: The template can check for FIRST and LAST, which will be
...
set for the first and last inlined page. Useful for templates that build
tables and the like.
2008-01-28 21:22:04 -05:00
fafb2edaa7
aggregate.pm: Replace Unicode apostrophe with ASCII to unbreak build
...
gettext choked on a Unicode apostrophe in the aggregate plugin, which
appeared in a new error message in commit
4f872b5633
2008-01-26 23:12:29 -08:00
4f872b5633
* aggregate: Fork a child process to handle the aggregation. This simplifies
...
the code, since that process can change internal state as needed, and
it will automatically be cleaned up for the parent process, which proceeds
to render the changes.
2008-01-24 17:22:39 -05:00
ba6b8e5e3e
* aggregate: Don't let feeds set creation times for pages in the future.
2008-01-16 02:01:00 -05:00
81c726982b
I've wrote a little patch for the bug in teximg (can only include fomula on
...
one page).
2008-01-09 20:04:51 -05:00
e01960e90a
not only markdown adds gunk, so remove it in the main htmlize function
2008-01-09 14:41:28 -05:00
Joey Hess
Josh Triplett
Patrick Winnertz