deac/instiki
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Avoid invalid WikiFile links

Browse source 
Reported by Andrew Stacey.
This commit is contained in:
Jacques Distler 2011-10-09 11:47:04 -05:00
parent 66b8f3454d
commit b48a56028a
3 changed files with 19 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
app/models/wiki_file.rb
View file

@ -12,10 +12,9 @@ class WikiFile < ActiveRecord::Base
first(:conditions => ['file_name = ?', file_name])
end
SANE_FILE_NAME = /^[a-zA-Z0-9\-_\. ]*$/
def validate
if file_name
if file_name !~ SANE_FILE_NAME
if ! is_valid?(file_name)
errors.add("file_name", "is invalid. Only latin characters, digits, dots, underscores, " +
"dashes and spaces are accepted")
elsif file_name == '.' or file_name == '..'
@ -58,7 +57,10 @@ class WikiFile < ActiveRecord::Base
require 'fileutils'
FileUtils.rm_f(content_path) if File.exists?(content_path)
end
SANE_FILE_NAME = /^[a-zA-Z0-9\-_\. ]*$/
def self.is_valid?(name)
name =~ SANE_FILE_NAME
end
end

7
lib/url_generator.rb
View file

@ -64,6 +64,7 @@ class UrlGenerator < AbstractUrlGenerator
private
def file_link(mode, name, text, web_address, known_file, description)
return bad_filename(name) unless WikiFile.is_valid?(name)
case mode
when :export
if known_file
@ -116,6 +117,7 @@ class UrlGenerator < AbstractUrlGenerator
end
def pic_link(mode, name, text, web_address, known_pic)
return bad_filename(name) unless WikiFile.is_valid?(name)
href = @controller.url_for :controller => 'file', :web => web_address, :action => 'file',
:id => name, :only_path => true
case mode
@ -141,6 +143,7 @@ class UrlGenerator < AbstractUrlGenerator
end
def media_link(mode, name, text, web_address, known_media, media_type)
return bad_filename(name) unless WikiFile.is_valid?(name)
href = @controller.url_for :controller => 'file', :web => web_address, :action => 'file',
:id => name, :only_path => true
case mode
@ -177,6 +180,10 @@ class UrlGenerator < AbstractUrlGenerator
private
def bad_filename(name)
"<span class='badWikiWord'>[[invalid filename: #{name}]]</span>"
end
def wikilink_for(mode, name, text, web_address)
web = Web.find_by_address(web_address)
action = web.published? && (web != @web || [:publish, :s5].include?(mode) ) ? 'published' : 'show'

6
public/stylesheets/instiki.css
View file

@ -100,6 +100,12 @@ border: 3px solid blue;
padding: 2px;
}
.badWikiWord {
background-color:#FCC;
border: 1px solid blue;
padding: 1px;
}
.deleteWikiWord:hover, .deleteWikiWord a:hover {
background-color:#F88;
}