diff --git a/app/models/wiki_file.rb b/app/models/wiki_file.rb index 2c8caab5..b0b5b418 100644 --- a/app/models/wiki_file.rb +++ b/app/models/wiki_file.rb @@ -12,10 +12,9 @@ class WikiFile < ActiveRecord::Base first(:conditions => ['file_name = ?', file_name]) end - SANE_FILE_NAME = /^[a-zA-Z0-9\-_\. ]*$/ def validate if file_name - if file_name !~ SANE_FILE_NAME + if ! is_valid?(file_name) errors.add("file_name", "is invalid. Only latin characters, digits, dots, underscores, " + "dashes and spaces are accepted") elsif file_name == '.' or file_name == '..' @@ -58,7 +57,10 @@ class WikiFile < ActiveRecord::Base require 'fileutils' FileUtils.rm_f(content_path) if File.exists?(content_path) end - - + + SANE_FILE_NAME = /^[a-zA-Z0-9\-_\. ]*$/ + def self.is_valid?(name) + name =~ SANE_FILE_NAME + end end diff --git a/lib/url_generator.rb b/lib/url_generator.rb index 22e6bd27..5d4a7dff 100644 --- a/lib/url_generator.rb +++ b/lib/url_generator.rb @@ -64,6 +64,7 @@ class UrlGenerator < AbstractUrlGenerator private def file_link(mode, name, text, web_address, known_file, description) + return bad_filename(name) unless WikiFile.is_valid?(name) case mode when :export if known_file @@ -116,6 +117,7 @@ class UrlGenerator < AbstractUrlGenerator end def pic_link(mode, name, text, web_address, known_pic) + return bad_filename(name) unless WikiFile.is_valid?(name) href = @controller.url_for :controller => 'file', :web => web_address, :action => 'file', :id => name, :only_path => true case mode @@ -141,6 +143,7 @@ class UrlGenerator < AbstractUrlGenerator end def media_link(mode, name, text, web_address, known_media, media_type) + return bad_filename(name) unless WikiFile.is_valid?(name) href = @controller.url_for :controller => 'file', :web => web_address, :action => 'file', :id => name, :only_path => true case mode @@ -177,6 +180,10 @@ class UrlGenerator < AbstractUrlGenerator private + def bad_filename(name) + "[[invalid filename: #{name}]]" + end + def wikilink_for(mode, name, text, web_address) web = Web.find_by_address(web_address) action = web.published? && (web != @web || [:publish, :s5].include?(mode) ) ? 'published' : 'show' diff --git a/public/stylesheets/instiki.css b/public/stylesheets/instiki.css index 1a6f72b4..d14510b3 100644 --- a/public/stylesheets/instiki.css +++ b/public/stylesheets/instiki.css @@ -100,6 +100,12 @@ border: 3px solid blue; padding: 2px; } +.badWikiWord { +background-color:#FCC; +border: 1px solid blue; +padding: 1px; +} + .deleteWikiWord:hover, .deleteWikiWord a:hover { background-color:#F88; }