From e708a87677f981459c1c631b55b037aba65cf9c8 Mon Sep 17 00:00:00 2001
From: dairiki <dairiki@96ab9672-09ca-45d6-a79d-3d69d39ca109>
Date: Mon, 17 Mar 2003 21:24:53 +0000
Subject: [PATCH] Fix security bugs in the RawHtml plugin.

Change the default configuration to allow use of plugin, since
I believe the plugin is now safe for general use. (Raw HTML will only
work on locked pages.)


git-svn-id: svn://svn.code.sf.net/p/phpwiki/code/trunk@2722 96ab9672-09ca-45d6-a79d-3d69d39ca109
---
 configurator.php       | 13 +++++++------
 index.php              |  9 ++++++---
 lib/plugin/RawHtml.php | 38 ++++++++++++++++++--------------------
 3 files changed, 31 insertions(+), 29 deletions(-)
diff --git a/configurator.php b/configurator.php
index 3523d3d89..584a4f527 100644
--- a/configurator.php
+++ b/configurator.php
@@ -20,7 +20,7 @@ printf("<?xml version=\"1.0\" encoding=\"%s\"?>\n", 'iso-8859-1');
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml">
 <head>
-<!-- $Id: configurator.php,v 1.16 2003-03-07 22:46:38 dairiki Exp $ -->
+<!-- $Id: configurator.php,v 1.17 2003-03-17 21:24:52 dairiki Exp $ -->
 <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
 <title>Configuration tool for PhpWiki 1.3.x</title>
 <style type="text/css" media="screen">
@@ -245,7 +245,7 @@ $properties["Part Null Settings"] =
 new unchangeable_variable('_partnullsettings', "
 define ('PHPWIKI_VERSION', '1.3.5pre');
 require \"lib/prepend.php\";
-rcs_id('\$Id: configurator.php,v 1.16 2003-03-07 22:46:38 dairiki Exp $');", "");
+rcs_id('\$Id: configurator.php,v 1.17 2003-03-17 21:24:52 dairiki Exp $');", "");
 
 
 $properties["Part One"] =
@@ -296,10 +296,11 @@ If true, only the admin user can make zip dumps, else zip dumps
 require no authentication.");
 
 $properties["Enable Plugin RawHtml"] =
-new boolean_define_optional('ENABLE_RAW_HTML', 
-                    array('false' => "Disabled. Recommended on public sites.",
-                          'true'  => "Enabled"), "
-Allow &lt; ?plugin RawHtml ...&gt;. Don't do this on a publicly accessable wiki for now.");
+new boolean_define_commented_optional
+('ENABLE_RAW_HTML', 
+ array('true'  => "Enabled",
+       'false' => "Disabled."), "
+Allow &lt; ?plugin RawHtml ...&gt;. Define to false to disalbe the RawHtml plugin.");
 
 $properties["Strict Mailable Pagedumps"] =
 new boolean_define_optional
diff --git a/index.php b/index.php
index a2d1d49ba..9e9a611be 100644
--- a/index.php
+++ b/index.php
@@ -61,7 +61,7 @@ if (!defined('DEBUG')) define ('DEBUG', 1);
 
 define ('PHPWIKI_VERSION', '1.3.5pre');
 require "lib/prepend.php";
-rcs_id('$Id: index.php,v 1.108 2003-03-07 22:47:01 dairiki Exp $');
+rcs_id('$Id: index.php,v 1.109 2003-03-17 21:24:50 dairiki Exp $');
 
 /////////////////////////////////////////////////////////////////////
 //
@@ -94,8 +94,8 @@ if (!defined('ADMIN_PASSWD')) define('ADMIN_PASSWD', "");
 // require no authentication.
 if (!defined('ZIPDUMP_AUTH')) define('ZIPDUMP_AUTH', false);
 
-// Don't do this on a publicly accessable wiki for now.
-if (!defined('ENABLE_RAW_HTML')) define('ENABLE_RAW_HTML', false);
+// Define to false to disable the RawHtml plugin.
+//if (!defined('ENABLE_RAW_HTML')) define('ENABLE_RAW_HTML', false);
 
 // If you define this to true, (MIME-type) page-dumps (either zip dumps,
 // or "dumps to directory" will be encoded using the quoted-printable
@@ -763,6 +763,9 @@ if (defined('VIRTUAL_PATH') and defined('USE_PATH_INFO')) {
 // End:   
 
 // $Log: not supported by cvs2svn $
+// Revision 1.108  2003/03/07 22:47:01  dairiki
+// A few more if(!defined(...))'s
+//
 // Revision 1.107  2003/03/07 20:51:54  dairiki
 // New feature: Automatic extraction of keywords (for the meta keywords tag)
 // from Category* and Topic* links on each page.
diff --git a/lib/plugin/RawHtml.php b/lib/plugin/RawHtml.php
index e8611ece9..f20a767d0 100644
--- a/lib/plugin/RawHtml.php
+++ b/lib/plugin/RawHtml.php
@@ -1,5 +1,5 @@
 <?php // -*-php-*-
-rcs_id('$Id: RawHtml.php,v 1.5 2003-01-18 22:01:43 carstenklapp Exp $');
+rcs_id('$Id: RawHtml.php,v 1.6 2003-03-17 21:24:53 dairiki Exp $');
 /**
  Copyright 1999, 2000, 2001, 2002 $ThePhpWikiProgrammingTeam
 
@@ -20,16 +20,10 @@ rcs_id('$Id: RawHtml.php,v 1.5 2003-01-18 22:01:43 carstenklapp Exp $');
  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
-// Define ENABLE_RAW_HTML to true to enable the RawHtml plugin.
-//
-// IMPORTANT!!!: This plugin is currently insecure, as it's method of
-// determining whether it was invoked from a locked page is flawed.
-// (See the FIXME: comment below.)
-//
-// ENABLE AT YOUR OWN RISK!!!
+// Define ENABLE_RAW_HTML to false (in index.php) to disable the RawHtml plugin.
 //
 if (!defined('ENABLE_RAW_HTML'))
-    define('ENABLE_RAW_HTML', false);
+    define('ENABLE_RAW_HTML', true);
 
 /**
  * A plugin to provide for raw HTML within wiki pages.
@@ -47,23 +41,22 @@ extends WikiPlugin
 
     function getVersion() {
         return preg_replace("/[Revision: $]/", '',
-                            "\$Revision: 1.5 $");
+                            "\$Revision: 1.6 $");
     }
 
-    function run($dbi, $argstr, $request) {
+    function run($dbi, $argstr, &$request, $basepage) {
         if (!defined('ENABLE_RAW_HTML') || ! ENABLE_RAW_HTML) {
-            return $this->error(_("Raw HTML is disabled in this wiki."));
+            return $this->disabled(_("Raw HTML is disabled in this wiki."));
         }
+        if (!$basepage) {
+            return $this->error("$basepage unset?");
+        }
+        
+        $page = $request->getPage($basepage);
 
-        // FIXME: this test for lockedness is badly flawed.  It checks
-        // the requested pages locked state, not the page the plugin
-        // invocation came from.  (These could be different in the
-        // case of ActionPages, or where the IncludePage plugin is
-        // used.)
-        $page = $request->getPage();
         if (! $page->get('locked')) {
-            return $this->error(fmt(_("%s is only allowed in locked pages."),
-                                    _("Raw HTML")));
+            return $this->disabled(fmt(_("%s is only allowed in locked pages."),
+                                       _("Raw HTML")));
         }
 
         return HTML::raw($argstr);
@@ -71,6 +64,11 @@ extends WikiPlugin
 }
 
 // $Log: not supported by cvs2svn $
+// Revision 1.5  2003/01/18 22:01:43  carstenklapp
+// Code cleanup:
+// Reformatting & tabs to spaces;
+// Added copyleft, getVersion, getDescription, rcs_id.
+//
 
 // For emacs users
 // Local Variables:
-- 
2.45.0

