Commit Graph

3311 Commits (7562350a3a2ed9aee52ed17972b80cafaf39c540)

Author SHA1 Message Date
Simon McVittie 4ad4fc33b5 git: write proposed attachment to temp file without going via system() 2016-12-28 21:32:12 +00:00
Simon McVittie 7f2235478d git: change calling convention of safe_git to have named arguments 2016-12-28 21:32:12 +00:00
Simon McVittie 7e84a1f9d8 git: Do the revert operation in a secondary working tree
This avoids leaving the git directory in an inconsistent state if the
host system is rebooted while we are processing a revert.
2016-12-28 21:32:12 +00:00
Simon McVittie 39b8931ad3 git: Turn $git_dir into a stack
This will be necessary when we use a secondary working tree to do
reverts without leaving the primary working tree in an inconsistent
state.
2016-12-28 21:32:12 +00:00
Simon McVittie a8a7462382 Try revert operations (on a branch) before approving them
Otherwise, we have a time-of-check/time-of-use vulnerability:
rcs_preprevert previously looked at what changed in the commit we are
reverting, not at what would result from reverting it now. In
particular, if some files were renamed since the commit we are
reverting, a revert of changes that were within the designated
subdirectory and allowed by check_canchange() might now affect
files that are outside the designated subdirectory or disallowed
by check_canchange().

It is not sufficient to disable rename detection, since git older
than 2.8.0rc0 (in particular the version in Debian stable) silently
accepts and ignores the relevant options.

OVE-20161226-0002
2016-12-28 21:32:12 +00:00
Simon McVittie 469c842fd5 Revert "Tell `git revert` not to follow renames"
This doesn't work prior to git 2.8: `git revert` silently ignores the
option and succeeds. We will have to fix CVE-2016-10026 some other way.

This reverts commit 9cada49ed6.
2016-12-28 21:32:12 +00:00
Simon McVittie c1120bbbe8 Force CGI::FormBuilder->field to scalar context where necessary
CGI::FormBuilder->field has behaviour similar to the CGI.pm misfeature
we avoided in f4ec7b0. Force it into scalar context where it is used
in an argument list.

This prevents two (relatively minor) commit metadata forgery
vulnerabilities:

* In the comments plugin, an attacker who was able to post a comment
  could give it a user-specified author and author-URL even if the wiki
  configuration did not allow for that, by crafting multiple values
  to other fields.
* In the editpage plugin, an attacker who was able to edit a page
  could potentially forge commit authorship by crafting multiple values
  for the rcsinfo field.

The remaining plugins changed in this commit appear to have been
protected by use of explicit scalar prototypes for the called functions,
but have been changed anyway to make them more obviously correct.
In particular, checkpassword() in passwordauth has a known prototype,
so an attacker cannot trick it into treating multiple values of the
name field as being the username, password and field to check for.

OVE-20161226-0001
2016-12-28 21:32:12 +00:00
Simon McVittie e193c75b7d git: do not fail to commit if committer is anonymous 2016-12-28 21:32:12 +00:00
Simon McVittie a67f4d3944 git: don't issue a warning if rcsinfo is undefined
The intention here seems to be that $prev may be undefined, and the
only way that can legitimately happen is for $params{token} to be
undefined too.
2016-12-28 21:32:12 +00:00
intrigeri c1890c116d Make pagestats output more deterministic.
Sort in lexical order the pages that have the same number of hits.
2016-12-19 18:21:07 +00:00
Simon McVittie 9cada49ed6 Tell `git revert` not to follow renames
Otherwise, we have an authorization bypass vulnerability: rcs_preprevert
looks at what changed in the commit we are reverting, not at what would
result from reverting it now. In particular, if some files were renamed
since the commit we are reverting, a revert of changes that were within
the designated subdirectory and allowed by check_canchange() might now
affect files that are outside the designated subdirectory or disallowed
by check_canchange().

Signed-off-by: Simon McVittie <smcv@debian.org>
2016-12-19 18:21:07 +00:00
Simon McVittie b0b1428e62 cgitemplate: actually remove dead code
Signed-off-by: Simon McVittie <smcv@debian.org>
2016-12-19 13:20:55 +00:00
Joey Hess 68e2320696
inline: Prevent creating a file named ".mdwn" when the postform is submitted with an empty title. 2016-09-21 13:51:42 -04:00
Amitai Schlair 85c10d149b Update my surname to its new legal spelling. 2016-09-14 14:28:01 -04:00
Simon McVittie 276f0cf578 Use git log --no-renames for recentchanges
Otherwise, recent git releases show renames as renames, and we do not
see that newdir/test5 was affected.

Bug-Debian: https://bugs.debian.org/835612
2016-09-03 23:47:06 +01:00
Joey Hess d9bfe760d1
improve warning message for multiple sources for page 2016-05-31 15:29:09 -04:00
Simon McVittie 5f6f9a1bea Wrapper: allocate new environment dynamically
Otherwise, if third-party plugins extend newenviron by more than
3 entries, we could overflow the array. It seems unlikely that any
third-party plugin manipulates newenviron in practice, so this
is mostly theoretical. Just in case, I have deliberately avoided
using "i" as the variable name, so that any third-party plugin
that was manipulating newenviron directly will now result in the
wrapper failing to compile.

I have not assumed that realloc(NULL, ...) works as an equivalent of
malloc(...), in case there are still operating systems where that
doesn't work.
2016-05-11 09:18:14 +01:00
Amitai Schlair 89af9ecc57 Detect image type from .JPG just like .jpg (etc.). 2016-05-08 18:31:02 -04:00
Simon McVittie 47b180e35f img: make img_allowed_formats case-insensitive 2016-05-07 23:22:52 +01:00
Simon McVittie 125461cab7 inline: expand show=N backwards compatibility to negative N
[[plugins/contrib]] uses show=-1 to show the post-creation widget
without actually inlining anything.
2016-05-06 22:51:02 +01:00
Simon McVittie 984ba82f1b img: Add back support for SVG images, bypassing ImageMagick and simply passing the SVG through to the browser
SVG scaling by img directives has subtly changed; where before size=wxh
would preserve aspect ratio, this cannot be done when passing them through
and so specifying both a width and height can change the SVG's aspect
ratio.

(This patch looks significantly more complex than it was, because a large
block of code had to be indented.)

[smcv: drop trailing whitespace, fix some spelling]
2016-05-06 06:57:12 +01:00
Simon McVittie 170cd41489 img: check magic number before giving common formats to ImageMagick
This mitigates CVE-2016-3714 and similar vulnerabilities by
avoiding passing obviously-wrong input to ImageMagick decoders.
2016-05-05 23:43:50 +01:00
Simon McVittie 545a7bbbf0 img: restrict to JPEG, PNG and GIF images by default
This mitigates CVE-2016-3714. Wiki administrators who know that they
have prevented arbitrary code execution via other formats can re-enable
the other formats if desired.
2016-05-05 23:43:50 +01:00
Simon McVittie 54a9f8d07d img: force common Web formats to be interpreted according to extension
A site administrator might unwisely set allowed_attachments to
something like '*.jpg or *.png'; if they do, an attacker could attach,
for example, a SVG file named attachment.jpg.

This mitigates CVE-2016-3714.
2016-05-05 23:43:50 +01:00
Simon McVittie 32ef584dc5 HTML-escape error messages (OVE-20160505-0012)
The instance in cgierror() is a potential cross-site scripting attack,
because an attacker could conceivably cause some module to raise an
exception that includes attacker-supplied HTML in its message, for
example via a crafted filename. (OVE-20160505-0012)

The instances in preprocess() is just correctness. It is not a
cross-site scripting attack, because an attacker could equally well
write the desired HTML themselves; the sanitize hook is what
protects us from cross-site scripting here.
2016-05-05 23:43:17 +01:00
Florian Wagner bbdba8d770
Correctly handle filenames starting with a dash in add/rm/mv. 2016-03-17 11:01:27 -04:00
Amitai Schlair 63fa0ef5ba Process .md like .mdwn, but disallow web creation. 2016-03-08 14:31:15 -05:00
Joey Hess 8d28f70b37
loginselector: When only openid and emailauth are enabled, but passwordauth is not, avoid showing a "Other" box which opens an empty form. 2016-03-02 16:35:16 -04:00
Amitai Schlair f93544db76 Fix typo. 2016-02-20 22:00:54 -05:00
Simon McVittie 7aca0d40a3 Compose relative URLs in RSS feeds correctly
If the relative link from the (page generating the) RSS to the target
would start with "./" or "../", just concatenating it with the URL to
the directory containing the RSS is not sufficient. Go via
URI::new_abs to fix this.
2016-01-21 08:40:14 +00:00
Simon McVittie 855b757f37 Force comments URL in RSS feeds to be absolute
Now I'm going to get bug reports about wanting the URLs to be
protocol-relative, but we can't win there as long as we generate RSS,
because RSS doesn't have well-defined semantics for relative URLs
(and the W3C's validator complains about them). If absolute URLs are
a problem for you, please use Atom feeds.
2016-01-21 07:50:13 +00:00
Simon McVittie 317d19842c Silence "used only once: possible typo" warnings for variables that are part of modules' APIs 2016-01-19 11:24:18 +00:00
Simon McVittie 72c3b81efb Merge remote-tracking branch 'smcv/pagestats-show' 2015-11-30 20:58:54 +00:00
Simon McVittie b199349ffd Merge remote-tracking branch 'smcv/ready/limit' 2015-11-30 20:55:34 +00:00
Simon McVittie 1f635c6dca ensure_committer: don't do anything if we have the environment variables 2015-11-30 20:46:58 +00:00
Simon McVittie 8550c39701 Don't memoize ensure_committer
This makes it harder to test, and if we're invoking git anyway,
a couple of extra subprocesses are no big deal.
2015-11-30 20:46:58 +00:00
Simon McVittie ed1e1ebe70 git: if no committer identity is known, set it to "IkiWiki <ikiwiki.info>" in .git/config
This resolves commit errors in versions of git that require a non-trivial
committer identity.
2015-11-30 19:34:04 +00:00
Joey Hess 32923e732b emailauth: Added emailauth_sender config. 2015-10-02 11:49:47 -04:00
Amitai Schlair 09916a90ed Fix [[!meta name=foo]] by closing the open quote. 2015-08-22 22:34:53 -04:00
Amitai Schlair 604d0391ba Squelch regex deprecation warnings from Perl 5.22.
Specifically:

"Unescaped left brace in regex is deprecated, passed through in regex"
2015-06-14 21:35:51 -04:00
Simon McVittie 7a2117bf8c img: stop ImageMagick trying to be clever if filenames contain a colon
$im->Read() takes a filename-like argument with several sets of special
syntax. Most of the possible metacharacters are escaped by the
default `wiki_file_chars` (and in any case not particularly disruptive),
but the colon ":" is not.

It seems the way to force ImageMagick to treat colons within the
filename as literal is to prepend a colon, so do that.
2015-06-13 20:00:08 +01:00
Simon McVittie f2365c3e66 inline: change default sort order from age to "age title" for determinism 2015-06-13 19:58:37 +01:00
Simon McVittie 014b9eb1b7 polygen: if deterministic build is requested, use a well-known random seed 2015-06-09 22:30:44 +01:00
Simon McVittie 361076e55d haiku: if deterministic build is requested, return a hard-coded haiku 2015-06-09 22:30:43 +01:00
Simon McVittie 6add4fd4fc Sort backlinks deterministically, by falling back to sorting by href if the link text is identical 2015-06-09 22:30:43 +01:00
Simon McVittie 8e007666d4 brokenlinks: sort the pages that link to the missing page, for better reproducibility 2015-06-09 22:28:31 +01:00
Simon McVittie 2fe003dac4 Populate pagectime from mtime or inode change time, whichever is older
When building ikiwiki from a tarball, the mtime (conceptually, the
last modification date of the file) is preserved by tar, but the inode
change time (creation/metadata-change date of *this copy* of the file)
is not. This seems to lead to unstable sort ordering and
unreproducible builds.

The page can't possibly have been modified before it was created, so
we can assume that the modification date is an upper bound for the
creation date.
2015-06-09 22:22:54 +01:00
Simon McVittie f00ccd0bf6 In rebuilds, assume that every page has been scanned by the time the scan phase ends
This doesn't prevent memory from being used to track what we have
and haven't scanned, but it does make it temporary.

This only applies to rebuilds, as a way to avoid breaking the
templatebody plugin, unlike the earlier version of this optimization.
2015-06-09 00:14:57 +01:00
Simon McVittie 5fd863b5b0 Revert "Assume that every page has been scanned by the time the scan phase ends"
This reverts commit c04a26f3e7, which
turns out to break the templatebody directive: readtemplate() relies
on scan() populating %templates, but if scan() is a no-op after
leaving the scan phase, we can't rely on that.

The assumption made by skipping scan() after the end of the render phase
is that everything that comes from a scan is already in the index.
However, we don't really want to put template bodies in the index:
that would force us to load and save them on every refresh, and
redundantly persist them to disk.

Test-case:

% make clean
% ./Makefile.PL
% make
% grep -E '<div class="notebox">|Use this template to' html/sandbox.html
% touch doc/sandbox/New_blog_entry.mdwn          # sandbox inlines this
% make
% grep -E '<div class="notebox">|Use this template to' html/sandbox.html

Good result: html/sandbox.html contains <div class="notebox"> both times

Bad result: html/sandbox.html contains "Use this template to..." the
second time
2015-06-08 23:47:14 +01:00
Simon McVittie 7a52c87a8c Make the attachment plugin work with CGI.pm 4.x (Closes: #786586; workaround for #786587 in libcgi-pm-perl) 2015-06-07 14:51:13 +01:00