X-Git-Url: https://git.stderr.nl/gitweb?p=matthijs%2Fupstream%2Fblosxom.git;a=blobdiff_plain;f=blosxom.cgi;h=c079ab257a6a53a511ec8f264d0a71ca16929886;hp=9162488ad1b0221ba162325079f0eb790004f497;hb=d70589b00686a9eab5e34eafcc3b144c73ee893e;hpb=78104789ca97d102152d88b983af4f9c709c0247 diff --git a/blosxom.cgi b/blosxom.cgi index 9162488..c079ab2 100755 --- a/blosxom.cgi +++ b/blosxom.cgi @@ -1,13 +1,63 @@ #!/usr/bin/perl # Blosxom -# Author: Rael Dornfest (2002-2003), The Blosxom Development Team (2005-2008) -# Version: 2.1.0+dev ($Id: blosxom.cgi,v 1.79 2008/07/24 16:24:07 xtaran Exp $) +# Author: Rael Dornfest (2002-2003), The Blosxom Development Team (2005-2009) +# Version: 2.1.2 ($Id: blosxom.cgi,v 1.97 2009/07/19 17:14:20 xtaran Exp $) # Home/Docs/Licensing: http://blosxom.sourceforge.net/ # Development/Downloads: http://sourceforge.net/projects/blosxom package blosxom; +=head1 NAME + +blosxom - A lightweight yet feature-packed weblog + +=head1 SYNOPSIS + +B is a simple web log (blog) CGI script written in perl. + +=head1 DESCRIPTION + +B (pronounced "I") is a lightweight yet feature-packed +weblog application designed from the ground up with simplicity, +usability, and interoperability in mind. + +Fundamental is its reliance upon the file system, folders and files +as its content database. Blosxom's weblog entries are plain text +files like any other. Write from the comfort of your favorite text +editor and hit the Save button. Create, edit, rename, and delete entries +on the command-line, via FTP, WebDAV, or anything else you +might use to manipulate your files. There's no import or export; entries +are nothing more complex than title on the first line, body being +everything thereafter. + +Despite its tiny footprint, Blosxom doesn't skimp on features, sporting +the majority of features one would find in any other Weblog application. + +Blosxom is simple, straightforward, minimalist Perl affording even the +dabbler an opportunity for experimentation and customization. And +last, but not least, Blosxom is open source and free for the taking and +altering. + +=head1 USAGE + +Write a weblog entry, and place it into the main data directory. Place +the the title is on the first line; the body is everything afterwards. +For example, create a file named I and put in it something +like this: + + First Blosxom Post! + + I have successfully installed blosxom on this system. For more + information on blosxom, see the author's blosxom site. + +Place the file in the directory under the I<$datadir> points to. Be +sure to change the default location to be somewhere accessable by the +web server that runs blosxom as a CGI program. + +=cut + # --- Configurable variables ----- # What's this blog's title? @@ -25,12 +75,16 @@ $blog_encoding = "UTF-8"; # Where are this blog's entries kept? $datadir = "/Library/WebServer/Documents/blosxom"; -# What's my preferred base URL for this blog (leave blank for automatic)? +# What's my preferred base URL for this blog (leave blank for +# automatic)? $url = ""; # Should I stick only to the datadir for items or travel down the # directory hierarchy looking for items? If so, to what depth? -# 0 = infinite depth (aka grab everything), 1 = datadir only, n = n levels down +# +# 0 = infinite depth (aka grab everything), 1 = datadir only, +# n = n levels down + $depth = 0; # How many entries should I show on the home page? @@ -47,8 +101,8 @@ $show_future_entries = 0; # --- Plugins (Optional) ----- -# File listing plugins blosxom should load -# (if empty blosxom will load all plugins in $plugin_dir and $plugin_path directories) +# File listing plugins blosxom should load (if empty blosxom will load +# all plugins in $plugin_dir and $plugin_path directories) $plugin_list = ""; # Where are my plugins kept? @@ -57,8 +111,8 @@ $plugin_dir = ""; # Where should my plugins keep their state information? $plugin_state_dir = "$plugin_dir/state"; -# Additional plugins location -# List of directories, separated by ';' on windows, ':' everywhere else +# Additional plugins location. A list of directories, separated by ';' +# on windows, ':' everywhere else. $plugin_path = ""; # --- Static Rendering ----- @@ -66,7 +120,8 @@ $plugin_path = ""; # Where are this blog's static files to be created? $static_dir = "/Library/WebServer/Documents/blog"; -# What's my administrative password (you must set this for static rendering)? +# What's my administrative password (you must set this for static +# rendering)? $static_password = ""; # What flavours should I generate statically? @@ -76,10 +131,120 @@ $static_password = ""; # 0 = no, 1 = yes $static_entries = 0; +# --- Advanced Encoding Options ----- + +# Should I encode entities for xml content-types? (plugins can turn +# this off if they do it themselves) +$encode_xml_entities = 1; + +# Should I encode 8 bit special characters, e.g. umlauts in URLs, e.g. +# convert an ISO-Latin-1 \"o to %F6? (off by default for now; plugins +# can change this, too) +$encode_8bit_chars = 0; + +# RegExp matching all characters which should be URL encoded in links. +# Defaults to anything but numbers, letters, slash, colon, dash, +# underscore and dot. +$url_escape_re = qr([^-/a-zA-Z0-9:._]); + # -------------------------------- -use vars - qw! $version $blog_title $blog_description $blog_language $blog_encoding $datadir $url %template $template $depth $num_entries $file_extension $default_flavour $static_or_dynamic $config_dir $plugin_list $plugin_path $plugin_dir $plugin_state_dir @plugins %plugins $static_dir $static_password @static_flavours $static_entries $path_info_full $path_info $path_info_yr $path_info_mo $path_info_da $path_info_mo_num $flavour $static_or_dynamic %month2num @num2month $interpolate $entries $output $header $show_future_entries %files %indexes %others $encode_xml_entities $content_type !; +=head1 ENVIRONMENT + +=over + +=item B + +Points to the location of the configuration file. This will be +considered as first option, if it's set. + + +=item B + +The here named directory will be tried unless the above mentioned +environment variable is set and tested for a contained blosxom.conf +file. + + +=back + + +=head1 FILES + +=over + +=item B + +The CGI script itself. Please note that the location might depend on +your installation. + +=item B + +The default configuration file location. This is rather taken as last +ressort if no other configuration location is set through environment +variables. + +=back + + +=head1 AUTHOR + +Rael Dornfest was the original author of blosxom. The +development was picked up by a team of dedicated users of blosxom since +2005. See > for more information. + +=cut + + +use vars qw! + $version + $blog_title + $blog_description + $blog_language + $blog_encoding + $datadir + $url + %template + $template + $depth + $num_entries + $file_extension + $default_flavour + $static_or_dynamic + $config_dir + $plugin_list + $plugin_path + $plugin_dir + $plugin_state_dir + @plugins + %plugins + $static_dir + $static_password + @static_flavours + $static_entries + $path_info_full + $path_info + $path_info_yr + $path_info_mo + $path_info_da + $path_info_mo_num + $flavour + $static_or_dynamic + %month2num + @num2month + $interpolate + $entries + $output + $header + $show_future_entries + %files + %indexes + %others + $encode_xml_entities + $encode_8bit_chars + $url_escape_re + $content_type +!; use strict; use FileHandle; @@ -88,10 +253,7 @@ use File::stat; use Time::Local; use CGI qw/:standard :netscape/; -$version = "2.1.0"; - -# Should I encode entities for xml content-types? (plugins can turn this off if they do it themselves) -$encode_xml_entities = 1; +$version = "2.1.2+dev"; # Load configuration from $ENV{BLOSXOM_CONFIG_DIR}/blosxom.conf, if it exists my $blosxom_config; @@ -142,20 +304,39 @@ my $fh = new FileHandle; ); @num2month = sort { $month2num{$a} <=> $month2num{$b} } keys %month2num; -# Use the stated preferred URL or figure it out automatically -$url ||= url( -path_info => 1 ); -# Unescape %XX hex codes (from URI::Escape::uri_unescape) -$url =~ s/%([0-9A-Fa-f]{2})/chr(hex($1))/eg; -$url =~ s/^included:/http:/ if $ENV{SERVER_PROTOCOL} eq 'INCLUDED'; - -# NOTE: Since v3.12, it looks as if CGI.pm misbehaves for SSIs and -# always appends path_info to the url. To fix this, we always -# request an url with path_info, and always remove it from the end of the -# string. -my $pi_len = length $ENV{PATH_INFO}; -my $might_be_pi = substr( $url, -$pi_len ); -substr( $url, -length $ENV{PATH_INFO} ) = '' - if $might_be_pi eq $ENV{PATH_INFO}; +# Use the stated preferred URL or figure it out automatically. Set +# $url manually in the config section above if CGI.pm doesn't guess +# the base URL correctly, e.g. when called from a Server Side Includes +# document or so. +unless ($url) { + $url = url(); + + # Unescape %XX hex codes (from URI::Escape::uri_unescape) + $url =~ s/%([0-9A-Fa-f]{2})/chr(hex($1))/eg; + + # Support being called from inside a SSI document + $url =~ s/^included:/http:/ if $ENV{SERVER_PROTOCOL} eq 'INCLUDED'; + + # Remove PATH_INFO if it is set but not removed by CGI.pm. This + # seems to happen when used with Apache's Alias directive or if + # called from inside a Server Side Include document. If that + # doesn't help either, set $url manually in the configuration. + $url =~ s/\Q$ENV{PATH_INFO}\E$// if defined $ENV{PATH_INFO}; + + # NOTE: + # + # There is one case where this code does more than necessary, too: + # If the URL requested is e.g. http://example.org/blog/blog and + # the base URL is correctly determined as http://example.org/blog + # by CGI.pm, then this code will incorrectly normalize the base + # URL down to http://example.org, because the same string as + # PATH_INFO is part of the base URL, too. But this is such a + # seldom case and can be fixed by setting $url in the config file, + # too. +} + +# The only modification done to a manually set base URL is to strip +# a trailing slash if present. $url =~ s!/$!!; @@ -195,6 +376,23 @@ if (! ($flavour = param('flav'))) { } $flavour ||= $default_flavour; +# Fix XSS in flavour name (CVE-2008-2236) +$flavour = blosxom_html_escape($flavour); + +sub blosxom_html_escape { + my $string = shift; + my %escape = ( + '<' => '<', + '>' => '>', + '&' => '&', + '"' => '"', + "'" => ''' + ); + my $escape_re = join '|' => keys %escape; + $string =~ s/($escape_re)/$escape{$1}/g; + $string; +} + # Global variable to be used in head/foot.{flavour} templates $path_info = ''; # Add all @path_info elements to $path_info till we come to one that could be a year @@ -525,7 +723,7 @@ sub generate { package blosxom; my $template = shift; # Interpolate scalars, namespaced scalars, and hash/hashref scalars - $template =~ s/(\$\w+(?:::\w+)*(?:(?:->)?{(['"]?)[-\w]+\2})?)/"defined $1 ? $1 : ''"/gee; + $template =~ s/(\$\w+(?:::\w+)*(?:(?:->)?{([\'\"]?)[-\w]+\2})?)/"defined $1 ? $1 : ''"/gee; return $template; }; @@ -660,33 +858,36 @@ sub generate { } } + # Save unescaped versions and allow them to be used in + # flavour templates. + use vars qw/$url_unesc $path_unesc $fn_unesc/; + $url_unesc = $url; + $path_unesc = $path; + $fn_unesc = $fn; + + # Fix special characters in links inside XML content if ( $encode_xml_entities && $content_type =~ m{\bxml\b} && $content_type !~ m{\bxhtml\b} ) { # Escape special characters inside the container - # The following line should be moved more towards to top for - # performance reasons -- Axel Beckert, 2008-07-22 - my $url_escape_re = qr([^-/a-zA-Z0-9:._]); - $url =~ s($url_escape_re)(sprintf('%%%02X', ord($&)))eg; $path =~ s($url_escape_re)(sprintf('%%%02X', ord($&)))eg; $fn =~ s($url_escape_re)(sprintf('%%%02X', ord($&)))eg; # Escape <, >, and &, and to produce valid RSS - my %escape = ( - '<' => '<', - '>' => '>', - '&' => '&', - '"' => '"', - "'" => ''' - ); - my $escape_re = join '|' => keys %escape; - $title =~ s/($escape_re)/$escape{$1}/g; - $body =~ s/($escape_re)/$escape{$1}/g; - $url =~ s/($escape_re)/$escape{$1}/g; - $path =~ s/($escape_re)/$escape{$1}/g; - $fn =~ s/($escape_re)/$escape{$1}/g; + $title = blosxom_html_escape($title); + $body = blosxom_html_escape($body); + $url = blosxom_html_escape($url); + $path = blosxom_html_escape($path); + $fn = blosxom_html_escape($fn); + } + + # Fix special characters in links inside XML content + if ($encode_8bit_chars) { + $url =~ s($url_escape_re)(sprintf('%%%02X', ord($&)))ge; + $path =~ s($url_escape_re)(sprintf('%%%02X', ord($&)))ge; + $fn =~ s($url_escape_re)(sprintf('%%%02X', ord($&)))ge; } $story = &$interpolate($story); @@ -795,7 +996,7 @@ rss story $title rss story $dw, $da $mo $yr $ti:00 $utc_offset rss story $url/$yr/$mo_num/$da#$fn rss story $path -rss story $url$path/$fn +rss story $url$path/$fn rss story $body rss story