X-Git-Url: https://codewiz.org/gitweb?a=blobdiff_plain;f=geekigeeki.py;h=1e2b065d05705ba8851177338d651429809590a4;hb=adf0fd62361a085ac014efa4985647864a46f603;hp=5a3eb8e58abc8b422d77a1b64bda50789886e3c0;hpb=fa845330d6f5721c898124dfb7b934afb8766fd7;p=geekigeeki.git

diff --git a/geekigeeki.py b/geekigeeki.py
index 5a3eb8e..1e2b065 100755
--- a/geekigeeki.py
+++ b/geekigeeki.py
@@ -85,7 +85,7 @@ def send_guru(msg_text, msg_type):
         print '    Software Failure.  Press left mouse button to continue.\n'
     print msg_text
     if msg_type == 'error':
-        print '      Guru Meditation #DEADBEEF.ABADC0DE'
+        print '\n      Guru Meditation #DEADBEEF.ABADC0DE'
     print '</pre>'
     # FIXME: This little JS snippet is harder to pass than ACID 3.0 
     print """
@@ -126,6 +126,10 @@ def send_title(name, text="Limbo", msg_text=None, msg_type='error', writable=Fal
     if not name:
         print ' <meta name="robots" content="noindex,nofollow" />'
 
+    for meta in meta_urls:
+        http_equiv, content = meta
+        print ' <meta http-equiv="%s" content="%s" />' % (http_equiv, relative_url(content))
+
     for link in link_urls:
         rel, href = link
         print ' <link rel="%s" href="%s" />' % (rel, relative_url(href))
@@ -179,6 +183,11 @@ def send_title(name, text="Limbo", msg_text=None, msg_type='error', writable=Fal
 
     print '<hr /></div>'
 
+def send_httperror(status="403 Not Found", query=""):
+    print "Status: %s" % status
+    send_title(None, msg_text=("%s: on query '%s'" % (status, query)))
+    send_footer(None)
+
 def link_tag(params, text=None, ss_class=None, privileged=False):
     if text is None:
         text = params # default
@@ -240,9 +249,17 @@ def print_search_stats(hits, searched):
     print "<p>%d hits out of %d pages searched.</p>" % (hits, searched)
 
 def handle_raw(pagename):
+    if not file_re.match(pagename):
+        send_httperror("403 Forbidden", pagename)
+        return
+
     Page(pagename).send_raw()
 
 def handle_edit(pagename):
+    if not file_re.match(pagename):
+        send_httperror("403 Forbidden", pagename)
+        return
+
     pg = Page(pagename)
     if 'save' in form:
         if form['file'].value:
@@ -353,7 +370,11 @@ class WikiFormatter:
 
         macro = globals().get('_macro_' + name)
         if not macro:
-            execfile("macros/" + name + ".py", globals())
+            try:
+                execfile("macros/" + name + ".py", globals())
+            except IOError, er:
+                if er.errno == errno.ENOENT:
+                    pass
             macro = globals().get('_macro_' + name)
         if macro:
             return macro(argv)
@@ -498,7 +519,7 @@ class WikiFormatter:
             + r"|(?P<hurl>\[\[([^\s\|]+)(?:\s*\|\s*([^\]]+)|)\]\])"
 
             # Inline HTML
-            + r"|(?P<html><(/|)(br|hr|div|form|iframe|input|span))"
+            + r"|(?P<html><(/|)(br|hr|div|span|form|iframe|input|textarea|a))"
             + r"|(?P<ent>[<>&])"
 
             # Auto links (LEGACY)
@@ -697,7 +718,7 @@ class Page:
         print '<div class="editor"><form name="editform" method="post" enctype="multipart/form-data" action="%s">' % relative_url(self.page_name)
         print '<input type="hidden" name="edit" value="%s">' % (self.page_name)
         print '<input type="input" id="editor" name="changelog" value="Edit page %s" accesskey="c" /><br />' % (self.page_name)
-        print '<textarea wrap="off" spellcheck="true" id="editor" name="savetext" rows="17" cols="100" accesskey="e">%s</textarea>' % (preview or self.get_raw_body())
+        print '<textarea wrap="off" spellcheck="true" id="editor" name="savetext" rows="17" cols="100" accesskey="e">%s</textarea>' % cgi.escape(preview or self.get_raw_body())
         print '<label for="file" accesskey="u">Or Upload a file:</label> <input type="file" name="file" value="%s" />' % file
         print """
             <br />
@@ -811,9 +832,7 @@ try:
                 else:
                     Page(query).format()
         else:
-            print "Status: 404 Not Found"
-            send_title(None, msg_text='Can\'t work out query: ' + query)
-            send_footer(None)
+            send_httperror("403 Forbidden", query)
 except Exception:
     import traceback
     msg_text = traceback.format_exc()
