Commit graph

144 commits

Author SHA1 Message Date
Jacques Distler
52a0b565a5 Merge branch 'bzr/golem' of /Users/distler/Sites/code/instiki 2009-09-07 16:08:33 -05:00
Jacques Distler
c79fef9c01 Clean, rather than Complain
Previously, if the user tried to submit content which was
malformed utf-8, Instiki would complain loudly to him.

A slightly more user-friendly approach was suggested by
the latest Rails 2.3.4, and a conversation with Sam Ruby
(who suggested some improvements).

Now, instead of complaining, we remove the offending bytes,
leaving a well-formed utf-8 string, which we pretend is what
the user meant to submit.
2009-09-07 16:02:36 -05:00
Jacques Distler
8957927c7a That'll Teach Me to Merge Indiscriminately!
Rollback rake upgrade task
2009-09-05 23:21:44 -05:00
James Herdman
4d9789644d Merge from parasew/master 2009-09-05 15:26:29 -04:00
Jacques Distler
f9a0c824ca Merge branch 'bzr/golem' of /Users/distler/Sites/code/instiki 2009-09-03 23:12:27 -05:00
Jacques Distler
342298ed0e Wikilinks to Published Webs
Should be to the published action. This
didn't work right for inter-web links.
(Reported by Mike Shulman)

Also, change some .length's to .size's
(for Andrew Stacey)
2009-09-03 23:09:10 -05:00
Jacques Distler
e75a0f9881 Merge branch 'bzr/golem' of /Users/distler/Sites/code/instiki 2009-08-29 23:38:08 -05:00
Jacques Distler
888e93a7fd Streamline Rake Task
Refactor the upgrade_instiki rake task.
Based on the (very nice) JHerdman's
  64d305f2a8
but defaults to 'production' environment, instead.
Instiki users don't know about production/development/test.
Instiki defaults to 'production'. So should its associated rake tasks.
2009-08-29 23:31:39 -05:00
James Herdman
64d305f2a8 Don't make ANY assumptions about the environment. Use the model and
Rails to do as much work as possible.
2009-08-29 14:20:08 -04:00
Jacques Distler
205fbcb898 Merge branch 'bzr/golem' of /Users/distler/Sites/code/instiki 2009-08-27 17:01:44 -05:00
Jacques Distler
c05d69bcff Make upgrade_instiki Rake Task Database-Agnostic
Reported by James Herdman.
2009-08-27 16:57:37 -05:00
Jacques Distler
9edb8f6045 Merge branch 'bzr/golem' of /Users/distler/Sites/code/instiki 2009-07-27 22:53:11 -05:00
Jacques Distler
0e0f666fb4 Rollbacks and Relative URLs
Ensure "rollback" locks page for editing. (reported by Toby Bartels)
Generate relative URLs, when possible. (Patch by Dennis Knauf)
2009-07-27 22:49:12 -05:00
Jacques Distler
191f7b3b2c Merge branch 'bzr/golem' of /Users/distler/Sites/code/instiki 2009-06-12 19:49:34 -05:00
Jacques Distler
9b857d3501 Test page_name, not text
Fix from Jason Blevins.
2009-06-12 19:47:56 -05:00
Jacques Distler
89757dccd4 Merge branch 'bzr/golem' of /Users/distler/Sites/code/instiki 2009-06-11 13:18:37 -05:00
Jacques Distler
c98d44606a Wikilinks with '." in the Page Name
Rails won't let you put "." in the page name.
This prevents creating new-page Wikilinks with
such names.
2009-06-11 13:16:10 -05:00
Jacques Distler
2995354b3a Merge branch 'bzr/golem' of /Users/distler/Sites/code/instiki 2009-06-06 21:09:30 -05:00
Jacques Distler
305b37b401 Another Bug-fix and some tests
Man, but this needs more tests ... !
2009-06-06 21:08:08 -05:00
Jacques Distler
8624a40bf8 Merge branch 'bzr/golem' of /Users/distler/Sites/code/instiki 2009-06-05 00:41:33 -05:00
Jacques Distler
0943b7e510 Expire Caches for Redirected Links
[[!redirect foo]] should expire all pages which reference "foo".
Sounds simple, but this was a really gnarly bug to fix.
2009-06-05 00:39:12 -05:00
Jacques Distler
3d626dae30 Merge branch 'bzr/golem' of /Users/distler/Sites/code/instiki 2009-06-02 22:24:50 -05:00
Jacques Distler
d7832ba262 Wiki Redirects and Page Renaming
Added the ability to rename existing pages.
[[!redirects Some Page Name]] redirects Wikilinks [[Some Page Name]] to
  the current page (assuming "Some Page Name" does not exist).
  Real pages trump redirects (though this may change, depending on 
  user feedback).
2009-06-02 22:17:15 -05:00
Jacques Distler
4d34abc8fa Merge branch 'bzr/golem' of /Users/distler/Sites/code/instiki 2009-05-07 17:03:03 -05:00
Jacques Distler
681065631c Add Support for SVG Clipping Paths
Add support in the sanitizer for <clipPath>, @clip-path and @clip-rule.
Suggested by Andrew Stacey.
2009-05-07 16:53:56 -05:00
Jacques Distler
6b09f76864 Merge branch 'bzr/golem' of /Users/distler/Sites/code/instiki 2009-03-30 23:55:20 -05:00
Jacques Distler
d5a65e6ac8 History Pages
From Jason Blevins:
  Create a "History" page for each wiki page.
  Link to it, and to the "Diff" page from "Recently Revised".
Also, correct a bug in listing/deleting links to uploaded
video and audio files.
2009-03-30 23:50:06 -05:00
Jacques Distler
72c4fb71df Merge branch 'bzr/golem' of /Users/distler/Sites/code/instiki 2009-03-27 09:27:00 -05:00
Jacques Distler
d425a70fad Yikes!
Yet more dangerously greedy Regexps in Maruku,
and one of my own.
2009-03-27 09:25:08 -05:00
Jacques Distler
3fdfad29a3 Merge branch 'bzr/golem' of /Users/distler/Sites/code/instiki 2009-03-03 12:19:13 -06:00
Jacques Distler
c7418af48d Support for HTML5 <audio>
As with <video>,

   [[foo.wav:audio]]

works now, producing an HTML5 <audio> element.
2009-03-03 12:17:14 -06:00
Jacques Distler
52f57f151c Merge branch 'bzr/golem' of /Users/distler/Sites/code/instiki 2009-03-02 02:39:23 -06:00
Jacques Distler
8ea8b6a8f7 <video> and x-sendfile
Using <object> and <embed> were forbidden for obvious
security reasons. Instiki now permits embedding video
via the HTML5 <video> element (Ogg/Theora encoded videos
only, with .ogg or .ogv extensions). You can even upload
videos with

    [[foo.ogg:video]]

Instiki now support x-sendfile. See the Proxying page for
configuring Apache (with the x-sendfile module). Lighttpd
should work similarly.

Update Rails to latest Edge (hopefully converging on RC2!).
2009-03-02 02:32:25 -06:00
Jacques Distler
d039840bb4 Merge branch 'bzr/golem' of /Users/distler/Sites/code/instiki 2009-02-27 19:24:43 -06:00
Jacques Distler
133c21b801 Bugfixes and Rails Edge
Update to Rails 2.3.1.
  (Actually, not quite. Doesn't look like 2.3.1 will be released
   today, but I REALLY want to push these bugfixes out.)
Removed bundled Rack (Rails 2.3.1 comes bundled with Rack 1.0).
Add
     config.action_view.cache_template_loading = true
  to production environment.
Fix FastCGI bug (http://rubyforge.org/tracker/index.php?func=detail&aid=24191&group_id=186&atid=783).
Fix WikiWords bug (http://rubyforge.org/pipermail/instiki-users/2009-February/001181.html).
2009-02-27 19:23:00 -06:00
Jacques Distler
5b258daef9 Added empty directories because Git is stupid. 2009-02-05 03:02:31 -06:00
Jacques Distler
4e14ccc74d Instiki 0.16.3: Rails 2.3.0
Instiki now runs on the Rails 2.3.0 Candidate Release.
Among other improvements, this means that it now 
automagically selects between WEBrick and Mongrel.

Just run

    ./instiki --daemon
2009-02-04 14:26:08 -06:00
Jacques Distler
43aadecc99 Links in Published Webs
Links in the 'show' action should be to the 'show' action.
Links in the 'published' action should be to the 'published' action.
Try to focus, Distler!
2009-02-01 16:17:14 -06:00
Jacques Distler
5d15e3f39d Security: Instiki 0.16.2
On Webs with file uploads enabled, uploaded files were stored
(in version 0.16.1 and earlier) in the public/ directory.

This was a security threat. A miscreant could upload a .html file.
When a user clicked on the link to the file, it was opened (unsanitized)
in the browser.

As of version 0.16.2, uploaded files are stored in the webs/
directory. Now, when the user clicks on the link, the file is sent
with the

    Content-Disposition: attachment

header set, which causes the file to be downloaded, rather than opened
in the browser. As always, files downloaded from the internets should be
treated with caution. At least, this way, they are not aoutomatically 
opened in the browser.

To move your existing uploaded files to the new location, do a

     rake upgrade_instiki
2009-01-26 00:21:30 -06:00
Jacques Distler
0b2a6935a2 Export XHTML Pages
When a Web uses one of the Markdown Text Filters, and you export
all the pages as a zip file, you'd like the MathML and SVG to
render when the pages are viewed locally. This means saving them
with a .xhtml extension. Users of non-XHTML-capable browsers or
Textile users should still get .html files.
2009-01-23 11:02:16 -06:00
Jacques Distler
13b7e1d766 A Real Fix For the "Backslashes in Included Equations" Bug
Ruby's String.sub!(pattern, replacement) routine is fundamentally
broken. But the block version works fine.

Using the broken routine in the Chunk handler was a subtle mistake.
2009-01-17 00:28:38 -06:00
Jacques Distler
294ac909c4 Don't hide equations, except in MarkdownMML and MarkdownPNG
In other engines, e.g. textile, the equation delimiters have no
special meaning. So they should not be used to hide content from
wiki processing.
2009-01-16 12:51:43 -06:00
Jacques Distler
a6d80426a9 Revert Revision 338
That didn't work with nested includes:
A: [[!include B]]
B: [[!include C]]
C:   fubar!

Added a test for that issue.
2009-01-15 22:42:09 -06:00
Jacques Distler
41006d20ef Fix the "Backslashes in Included Equations" Bug
See
  http://golem.ph.utexas.edu/instiki/revision/Known+Bugs?rev=3#IncludedEqs

Who knew that

      @pre_rendered = String.new(self)

was not the same as

      @pre_rendered = String.new
      @pre_rendered = self

?
2009-01-14 22:55:59 -06:00
Jacques Distler
074711d4c5 Hide Equations From WikiChunk Processing
WikiWord (and the like) could wreak havoc in equations. Protect them
(the way <a>, <pre> and <code> blocks are protected).

For some reason, this doesn't seem to work in inline equations.
Maruku is doing something funny there ... => one failing Unit Test.
2009-01-14 16:11:07 -06:00
Jacques Distler
5c20871ec4 Remove last vestige of CGI.unescapeHTML 2009-01-10 02:00:26 -06:00
Jacques Distler
82e7aa52c7 Referring Pages for File List
For the file_list  action, include the pages which link to the given file(s).
This required rejiggering so that that information is actually retained in the database.
Unfortunately, you'll actually need to revise the page(s) in question, because that's the
only time this information is updated in the database.
2009-01-10 00:18:25 -06:00
Jacques Distler
52c1f74ecc Add a couple of XSS tests.
Some more tests from Clint Ruoho. The main branch of Instiki (and, I guess,
the old sanitizer) are vulnerable.

Also: under Ruby 1.8.x, CGI.unescapeHTML screws up horribly decoding NCRs
which represent high-bit ASCII characters. UTF-8 agrees with 7-bit ASCII,
but CGI.unescapeHTML doesn't seem to know that they disagree for i>127.
2009-01-05 16:25:27 -06:00
Jacques Distler
5700d4513f Preliminary (?) Interface for Deleting Uploaded Files.
The simplest thing which could possibly work ...
2008-12-30 03:03:02 -06:00
Jacques Distler
c3c33b68dd Multiple leading capital letters in a WikiWord
CMyApp  is a WikiWord (at least, on other Wiki systems, like TWiki).
Should allow that here

Also, choose a more obscure name for the thread-local variable tracking
included chunks.
2008-12-25 17:41:35 -06:00