SECURITY: check filenames in editor
[geekigeeki.git] / geekigeeki.py
index d7e1a5a9e0d28a466e8f40b5704df5d4ea77148f..a7e99ed10121c9af816cfc76eddc0707edeeec94 100755 (executable)
@@ -31,7 +31,7 @@ from os import path, environ
 word_re = re.compile(r"^\b((([A-Z][a-z0-9]+){2,}/)*([A-Z][a-z0-9]+){2,})\b$")
 # FIXME: we accept stuff like foo/../bar and we shouldn't
 file_re = re.compile(r"^\b([A-Za-z0-9_\-][A-Za-z0-9_\.\-/]*)\b$")
-img_re = re.compile(r"^.*\.(png|gif|jpg|jpeg)$", re.IGNORECASE)
+img_re = re.compile(r"^.*\.(png|gif|jpg|jpeg|bmp|ico)$", re.IGNORECASE)
 url_re = re.compile(r"^[a-z]{3,8}://[^\s'\"]+\S$")
 link_re = re.compile("(?:\[\[|{{)([^\s\|]+)(?:\s*\|\s*([^\]]+)|)(?:\]\]|}})")
 
@@ -85,7 +85,7 @@ def send_guru(msg_text, msg_type):
         print '    Software Failure.  Press left mouse button to continue.\n'
     print msg_text
     if msg_type == 'error':
-        print '      Guru Meditation #DEADBEEF.ABADC0DE'
+        print '\n      Guru Meditation #DEADBEEF.ABADC0DE'
     print '</pre>'
     # FIXME: This little JS snippet is harder to pass than ACID 3.0 
     print """
@@ -110,7 +110,7 @@ def send_guru(msg_text, msg_type):
         }
     </script>"""
 
-def send_title(name, text="Limbo", msg_text=None, msg_type='error'):
+def send_title(name, text="Limbo", msg_text=None, msg_type='error', writable=False):
     global title_done
     if title_done: return
 
@@ -125,12 +125,23 @@ def send_title(name, text="Limbo", msg_text=None, msg_type='error'):
     print ' <meta http-equiv="Content-Type" content="application/xhtml+xml; charset=utf-8" />'
     if not name:
         print ' <meta name="robots" content="noindex,nofollow" />'
-    for css in css_url:
-        print ' <link rel="stylesheet" type="text/css" href="%s" />' % relative_url(css)
+
+    for link in link_urls:
+        rel, href = link
+        print ' <link rel="%s" href="%s" />' % (rel, relative_url(href))
+
+    if name and writable and privileged_url is not None:
+        print ' <link rel="alternate" type="application/x-wiki" title="Edit this page" href="%s" />' \
+            % (privileged_path() + '?edit=' + name)
+
+    if history_url is not None:
+        print ' <link rel="alternate" type="application/rss+xml" title="RSS" href="%s" />' \
+            % relative_url(history_url + '?a=rss')
+
     print '</head>'
 
     # Body
-    if name and privileged_url is not None:
+    if name and writable and privileged_url is not None:
         print '<body ondblclick="location.href=\'' + privileged_path() + '?edit=' + name + '\'">'
     else:
         print '<body>'
@@ -144,17 +155,21 @@ def send_title(name, text="Limbo", msg_text=None, msg_type='error'):
         print '  <b>' + link_tag('?fullsearch=' + name, text, 'navlink') + '</b> '
     else:
         print '  <b>' + text + '</b> '
-    print ' | ' + link_tag('FrontPage', 'Front Page', 'navlink')
+    print ' | ' + link_tag('FrontPage', 'Home', 'navlink')
     print ' | ' + link_tag('FindPage', 'Find Page', 'navlink')
     if 'history_url' in globals():
-        print ' | <a href="' + history_url + '" class="navlink">Recent Changes</a>'
+        print ' | <a href="' + relative_url(history_url) + '" class="navlink">Recent Changes</a>'
         if name:
-            print ' | <a href="' + history_url + '?a=history;f=' + name + '" class="navlink">Page History</a>'
+            print ' | <a href="' + relative_url(history_url + '?a=history;f=' + name) + '" class="navlink">Page History</a>'
 
     if name:
         print ' | ' + link_tag('?raw=' + name, 'Raw Text', 'navlink')
         if privileged_url is not None:
-            print ' | ' + link_tag('?edit=' + name, 'Edit Page', 'navlink', privileged=True)
+            if writable:
+                print ' | ' + link_tag('?edit=' + name, 'Edit', 'navlink', privileged=True)
+            else:
+                print ' | ' + link_tag(name, 'Login', 'navlink', privileged=True)
+
     else:
         print ' | <i>Immutable Page</i>'
 
@@ -164,6 +179,11 @@ def send_title(name, text="Limbo", msg_text=None, msg_type='error'):
 
     print '<hr /></div>'
 
+def send_httperror(status="403 Not Found", query=""):
+    print "Status: %s" % status
+    send_title(None, msg_text=("%s: on query '%s'" % (status, query)))
+    send_footer(None)
+
 def link_tag(params, text=None, ss_class=None, privileged=False):
     if text is None:
         text = params # default
@@ -225,15 +245,23 @@ def print_search_stats(hits, searched):
     print "<p>%d hits out of %d pages searched.</p>" % (hits, searched)
 
 def handle_raw(pagename):
+    if not file_re.match(pagename):
+        send_httperror("403 Forbidden", pagename)
+        return
+
     Page(pagename).send_raw()
 
 def handle_edit(pagename):
+    if not file_re.match(pagename):
+        send_httperror("403 Forbidden", pagename)
+        return
+
     pg = Page(pagename)
     if 'save' in form:
         if form['file'].value:
-            pg.save(form['file'].file.read())
+            pg.save(form['file'].file.read(), form['changelog'].value)
         else:
-            pg.save(form['savetext'].value.replace('\r\n', '\n'))
+            pg.save(form['savetext'].value.replace('\r\n', '\n'), form['changelog'].value)
         pg.format()
     elif 'cancel' in form:
         pg.msg_text = 'Editing canceled'
@@ -250,17 +278,20 @@ def make_index_key():
     return '<p><center>'+ ' | '.join(links) + '</center></p>'
 
 def page_list(dir = None, re = word_re):
-    return filter(re.match, os.listdir(dir or data_dir))
+    return sorted(filter(re.match, os.listdir(dir or data_dir)))
 
 def send_footer(name, mod_string=None):
     if globals().get('debug_cgi', False):
         cgi.print_arguments()
         cgi.print_form(form)
         cgi.print_environ()
-    print '<div id="footer"><hr />'
-    print ('<p class="copyright"><span class="benchmark">generated in %0.3fs</span>' +
-        ' by <a href="http://www.codewiz.org/wiki/GeekiGeeki">GeekiGeeki</a>' +
-        ' version %s</p>') % (clock() - start_time, __version__)
+    print '''
+<div id="footer"><hr />
+<p class="copyright">
+<a rel="license" href="http://creativecommons.org/licenses/by-sa/3.0/"><img class="license" alt="Creative Commons License" src="http://i.creativecommons.org/l/by-sa/3.0/80x15.png" /></a>
+<span class="benchmark">generated in %0.3fs</span> by <a href="http://www.codewiz.org/wiki/GeekiGeeki">GeekiGeeki</a> version %s
+</p>
+''' % (clock() - start_time, __version__)
     if mod_string:
         print '<p class="modified">last modified %s</p>' % mod_string
     print '</div></body></html>'
@@ -345,12 +376,11 @@ class WikiFormatter:
     def _hurl_repl(self, word):
         m = link_re.match(word)
         name = m.group(1)
-        if m.group(2) is None:
+        descr = m.group(2)
+        if descr is None:
             descr = name
         elif img_re.match(m.group(2)):
             descr = '<img border="0" src="' + descr + '" />'
-        else:
-            descr = m.group(2)
 
         return link_tag(name, descr, 'wikilink')
 
@@ -484,16 +514,16 @@ class WikiFormatter:
             + r"|(?P<html><(/|)(br|hr|div|form|iframe|input|span))"
             + r"|(?P<ent>[<>&])"
 
-            # Auto links
-            + r"|(?P<img>\b[a-zA-Z0-9_/-]+\.(png|gif|jpg|jpeg|bmp))" # LEGACY
-            + r"|(?P<word>\b(?:[A-Z][a-z]+){2,}\b)" # LEGACY
-            + r"|(?P<url>(http|https|ftp|mailto)\:[^\s'\"]+\S)" # LEGACY
-            + r"|(?P<email>[-\w._+]+\@[\w.-]+)" # LEGACY
+            # Auto links (LEGACY)
+            + r"|(?P<img>\b[a-zA-Z0-9_/-]+\.(png|gif|jpg|jpeg|bmp|ico))"
+            + r"|(?P<word>\b(?:[A-Z][a-z]+){2,}\b)"
+            + r"|(?P<url>(http|https|ftp|mailto)\:[^\s'\"]+\S)"
+            + r"|(?P<email>[-\w._+]+\@[\w.-]+)"
 
             # Lists, divs, spans
             + r"|(?P<li>^\s+[\*#] +)"
             + r"|(?P<pre>\{\{\{|\s*\}\}\})"
-            + r"|(?P<inl>\{\{([^\s\|]+)(?:\s*\|\s*([^\]]+)|)\}\})" #TODO
+            + r"|(?P<inl>\{\{([^\s\|]+)(?:\s*\|\s*([^\]]+)|)\}\})"
 
             # Tables
             + r"|(?P<tr>^\s*\|\|(=|)\s*)"
@@ -607,7 +637,7 @@ class Page:
                 self.attrs[m.group(1)] = m.group(2).strip()
                 #print "bernie: attrs[" + m.group(1) + "] = " + m.group(2) + "<br>\n"
         except IOError, er:
-            if er.errno != errno.ENOENT:
+            if er.errno != errno.ENOENT and er.errno != errno.EISDIR:
                 raise er
         return self.attrs
 
@@ -642,17 +672,16 @@ class Page:
             send_guru("Read access denied by ACLs", "notice")
 
     def format(self):
-        page_name = None
-        if self.can_write():
-            page_name = self.page_name
-
-        #css foo.css bar.css
-        global css_url
-        css_url = self.get_attr("css", "").split() + css_url
-
-        send_title(page_name, self.split_title(), msg_text=self.msg_text, msg_type=self.msg_type)
+        #css foo.css
+        value = self.get_attr("css", None)
+        if value:
+            global link_urls
+            link_urls += [ [ "stylesheet", value ] ]
+
+        send_title(self.page_name, self.split_title(),
+            msg_text=self.msg_text, msg_type=self.msg_type, writable=self.can_write())
         self.send_naked()
-        send_footer(page_name, self._last_modified())
+        send_footer(self.page_name, self._last_modified())
 
     def _last_modified(self):
         try:
@@ -678,18 +707,25 @@ class Page:
             + ' for ' + cgi.escape(remote_user())
             + ' from ' + cgi.escape(get_hostname(remote_host()))
             + '</b></p>')
-        print '<div class="editor"><form method="post" enctype="multipart/form-data" action="%s">' % relative_url(self.page_name)
+        print '<div class="editor"><form name="editform" method="post" enctype="multipart/form-data" action="%s">' % relative_url(self.page_name)
         print '<input type="hidden" name="edit" value="%s">' % (self.page_name)
-        print '<textarea wrap="off" spellcheck="true" id="editor" name="savetext" rows="17" cols="100">%s</textarea>' % (preview or self.get_raw_body())
-        print 'Or upload a file: <input type="file" name="file" value="%s" />' % file
+        print '<input type="input" id="editor" name="changelog" value="Edit page %s" accesskey="c" /><br />' % (self.page_name)
+        print '<textarea wrap="off" spellcheck="true" id="editor" name="savetext" rows="17" cols="100" accesskey="e">%s</textarea>' % (preview or self.get_raw_body())
+        print '<label for="file" accesskey="u">Or Upload a file:</label> <input type="file" name="file" value="%s" />' % file
         print """
             <br />
-            <input type="submit" name="save" value="Save" />
-            <input type="submit" name="preview" value="Preview" />
+            <input type="submit" name="save" value="Save" accesskey="s">
+            <input type="submit" name="preview" value="Preview" accesskey="p" />
             <input type="reset" value="Reset" />
             <input type="submit" name="cancel" value="Cancel" />
             <br />
-            </form></div>"""
+            </form></div>
+            <script language="javascript">
+            <!--
+            document.editform.savetext.focus()
+            //-->
+            </script>
+            """
         print "<p>" + Page('EditingTips').link_to() + "</p>"
         if preview:
             print "<div class='preview'>"
@@ -727,7 +763,7 @@ class Page:
                 if er.errno != errno.ENOENT: raise er
         os.rename(tmp_filename, name)
 
-    def save(self, newdata):
+    def save(self, newdata, changelog):
         if not self.can_write():
             self.msg_text = 'Write access denied by ACLs'
             self.msg_type = 'error'
@@ -740,7 +776,8 @@ class Page:
             cmd = ( post_edit_hook
                 + " '" + data_dir + '/' + self.page_name
                 + "' '" + remote_user()
-                + "' '" + remote_host() + "'"
+                + "' '" + remote_host()
+               + "' '" + changelog + "'"
             )
             out = os.popen(cmd)
             output = out.read()
@@ -787,9 +824,7 @@ try:
                 else:
                     Page(query).format()
         else:
-            print "Status: 404 Not Found"
-            send_title(None, msg_text='Can\'t work out query: ' + query)
-            send_footer(None)
+            send_httperror("403 Forbidden", query)
 except Exception:
     import traceback
     msg_text = traceback.format_exc()