Skip to content

Commit

Permalink
Remove the Export feature.
Browse files Browse the repository at this point in the history
This feature is a security risk; it provided multiple
vectors by which contents of files could be exposed.

API change: remove Network.Gitit.Export.
  • Loading branch information
jgm committed Aug 12, 2021
1 parent 735096f commit eed3263
Show file tree
Hide file tree
Showing 12 changed files with 9 additions and 384 deletions.
9 changes: 4 additions & 5 deletions README.markdown
Original file line number Diff line number Diff line change
Expand Up @@ -7,10 +7,9 @@ files are stored in a [git], [darcs], or [mercurial] repository
and may be modified either by using the VCS's command-line tools or
through the wiki's web interface. By default, pandoc's extended version
of markdown is used as a markup language, but reStructuredText, LaTeX, HTML,
DocBook, or Emacs Org-mode markup can also be used. Pages can be exported in a
number of different formats, including LaTeX, RTF, OpenOffice ODT, and
MediaWiki markup. Gitit can be configured to display TeX math (using
[texmath]) and highlighted source code (using [highlighting-kate]).
DocBook, or Emacs Org-mode markup can also be used. Gitit can
be configured to display TeX math (using [texmath]) and
highlighted source code (using [highlighting-kate]).

Other features include

Expand Down Expand Up @@ -411,7 +410,7 @@ Caching
By default, gitit does not cache content. If your wiki receives a lot of
traffic or contains pages that are slow to render, you may want to activate
caching. To do this, set the configuration option `use-cache` to `yes`.
By default, rendered pages, highlighted source files, and exported PDFs
By default, rendered pages, and highlighted source files
will be cached in the `cache` directory. (Another directory can be
specified by setting the `cache-dir` configuration option.)

Expand Down
9 changes: 1 addition & 8 deletions data/default.conf
Original file line number Diff line number Diff line change
Expand Up @@ -266,16 +266,9 @@ feed-days: 14
feed-refresh-time: 60
# number of minutes to cache feeds before refreshing

pdf-export: no
# if yes, PDF will appear in export options. PDF will be created using
# pdflatex, which must be installed and in the path. Note that PDF
# exports create significant additional server load.

pandoc-user-data:
# if a directory is specified, this will be searched for pandoc
# customizations. These can include a templates/ directory for custom
# templates for various export formats, an S5 directory for custom
# S5 styles, and a reference.odt for ODT exports. If no directory is
# customizations. If no directory is
# specified, $HOME/.pandoc will be searched. See pandoc's README for
# more information.

Expand Down
1 change: 0 additions & 1 deletion data/templates/pagetools.st
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,5 @@
<li><a href="$base$/_feed$pageUrl$" type="application/atom+xml" rel="alternate" title="This page's ATOM Feed">Atom feed</a> <img alt="feed icon" src="$base$/img/icons/feed.png"/></li>
$endif$
</ul>
$exportbox$
</fieldset>
</div>
1 change: 0 additions & 1 deletion gitit.cabal
Original file line number Diff line number Diff line change
Expand Up @@ -115,7 +115,6 @@ Library
Network.Gitit.Authentication.Github,
Network.Gitit.Util, Network.Gitit.Server
Network.Gitit.Cache, Network.Gitit.State,
Network.Gitit.Export,
Network.Gitit.Handlers,
Network.Gitit.Plugins, Network.Gitit.Rpxnow,
Network.Gitit.Page, Network.Gitit.Feed,
Expand Down
1 change: 0 additions & 1 deletion src/Network/Gitit.hs
Original file line number Diff line number Diff line change
Expand Up @@ -199,7 +199,6 @@ wikiHandlers =
authenticate ForModify (unlessNoDelete deletePage showPage) ]
, dir "_preview" preview
, guardIndex >> indexPage
, guardCommand "export" >> exportPage
, method POST >> guardCommand "cancel" >> showPage
, method POST >> guardCommand "update" >>
authenticate ForModify (unlessNoEdit updatePage showPage)
Expand Down
13 changes: 1 addition & 12 deletions src/Network/Gitit/Cache.hs
Original file line number Diff line number Diff line change
Expand Up @@ -41,23 +41,13 @@ import Control.Monad.Trans (liftIO)
import Text.Pandoc.UTF8 (encodePath)

-- | Expire a cached file, identified by its filename in the filestore.
-- If there is an associated exported PDF, expire it too.
-- Returns () after deleting a file from the cache, fails if no cached file.
expireCachedFile :: String -> GititServerPart ()
expireCachedFile file = do
cfg <- getConfig
let target = encodePath $ cacheDir cfg </> file
exists <- liftIO $ doesFileExist target
when exists $ liftIO $ do
liftIO $ removeFile target
expireCachedPDF target (defaultExtension cfg)

expireCachedPDF :: String -> String -> IO ()
expireCachedPDF file ext =
when (takeExtension file == "." ++ ext) $ do
let pdfname = file ++ ".export.pdf"
exists <- doesFileExist pdfname
when exists $ removeFile pdfname
when exists $ liftIO $ liftIO $ removeFile target

lookupCache :: String -> GititServerPart (Maybe (UTCTime, B.ByteString))
lookupCache file = do
Expand All @@ -84,4 +74,3 @@ cacheContents file contents = do
liftIO $ do
createDirectoryIfMissing True targetDir
B.writeFile target contents
expireCachedPDF target (defaultExtension cfg)
2 changes: 0 additions & 2 deletions src/Network/Gitit/Config.hs
Original file line number Diff line number Diff line change
Expand Up @@ -130,7 +130,6 @@ extractConfig cp = do
cfWikiTitle <- get cp "DEFAULT" "wiki-title"
cfFeedDays <- get cp "DEFAULT" "feed-days"
cfFeedRefreshTime <- get cp "DEFAULT" "feed-refresh-time"
cfPDFExport <- get cp "DEFAULT" "pdf-export"
cfPandocUserData <- get cp "DEFAULT" "pandoc-user-data"
cfXssSanitize <- get cp "DEFAULT" "xss-sanitize"
cfRecentActivityDays <- get cp "DEFAULT" "recent-activity-days"
Expand Down Expand Up @@ -232,7 +231,6 @@ extractConfig cp = do
, wikiTitle = cfWikiTitle
, feedDays = readNumber "feed-days" cfFeedDays
, feedRefreshTime = readNumber "feed-refresh-time" cfFeedRefreshTime
, pdfExport = cfPDFExport
, pandocUserData = if null cfPandocUserData
then Nothing
else Just cfPandocUserData
Expand Down
27 changes: 0 additions & 27 deletions src/Network/Gitit/ContentTransformer.hs
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,6 @@ module Network.Gitit.ContentTransformer
, showRawPage
, showFileAsText
, showPage
, exportPage
, showHighlightedSource
, showFile
, preview
Expand All @@ -45,7 +44,6 @@ module Network.Gitit.ContentTransformer
, textResponse
, mimeFileResponse
, mimeResponse
, exportPandoc
, applyWikiTemplate
-- * Content-type transformation combinators
, pageToWikiPandoc
Expand Down Expand Up @@ -79,7 +77,6 @@ import Data.List (stripPrefix)
import Data.Maybe (isNothing, mapMaybe)
import Data.Semigroup ((<>))
import Network.Gitit.Cache (lookupCache, cacheContents)
import Network.Gitit.Export (exportFormats)
import Network.Gitit.Framework hiding (uriPath)
import Network.Gitit.Layout
import Network.Gitit.Page (stringToPage)
Expand Down Expand Up @@ -186,10 +183,6 @@ showFileAsText = runFileTransformer rawTextResponse
showPage :: Handler
showPage = runPageTransformer htmlViaPandoc

-- | Responds with page exported into selected format.
exportPage :: Handler
exportPage = runPageTransformer exportViaPandoc

-- | Responds with highlighted source code.
showHighlightedSource :: Handler
showHighlightedSource = runFileTransformer highlightRawSource
Expand Down Expand Up @@ -220,15 +213,6 @@ applyPreCommitPlugins = runPageTransformer . applyPreCommitTransforms
rawTextResponse :: ContentTransformer Response
rawTextResponse = rawContents >>= textResponse

-- | Responds with a wiki page in the format specified
-- by the @format@ parameter.
exportViaPandoc :: ContentTransformer Response
exportViaPandoc = rawContents >>=
maybe mzero return >>=
contentsToPage >>=
pageToWikiPandoc >>=
exportPandoc

-- | Responds with a wiki page. Uses the cache when
-- possible and caches the rendered page when appropriate.
htmlViaPandoc :: ContentTransformer Response
Expand Down Expand Up @@ -322,17 +306,6 @@ mimeResponse :: Monad m
mimeResponse c mimeType =
return . setContentType mimeType . toResponse $ c

-- | Converts Pandoc to response using format specified in parameters.
exportPandoc :: Pandoc -> ContentTransformer Response
exportPandoc doc = do
params <- getParams
page <- getPageName
cfg <- lift getConfig
let format = pFormat params
case lookup format (exportFormats cfg) of
Nothing -> error $ "Unknown export format: " ++ format
Just writer -> lift (writer page doc)

-- | Adds the sidebar, page tabs, and other elements of the wiki page
-- layout to the raw content.
applyWikiTemplate :: Html -> ContentTransformer Response
Expand Down
Loading

0 comments on commit eed3263

Please sign in to comment.