nesta 0.9.10 → 0.9.11

data/CHANGES

@@ -1,3 +1,30 @@
+= 0.9.11 / (22 September 2011)
+
+ * Use Tilt to render the Markdown, Textile and Haml in content/pages.
+   RDiscount is now the default Markdown processor. To continue using
+   Maruku add it to Gemfile and call `Tilt.prefer Tilt::MarukuTemplate`
+   in your app.rb file.
+
+ * Remove trailing slashes from all URLs, redirecting to the URL without
+   the slash. See ticket #60 on GitHub.
+
+ * Added the 'Articles heading' metadata key. When articles are listed
+   on a category page, Nesta adds a heading above the articles based on
+   the category's title (e.g. "Articles on Thing").  If you set the
+   'Articles heading' metadata Nesta will allow you to override the
+   entire heading for a given page.
+
+ * Bug fix: require nesta/plugin automatically on load. The
+   Nesta::Plugin.register method is called by plugins as soon as they
+   are loaded, so we need to make it available. In 0.9.10 this method
+   wasn't available until too late.
+
+ * Bug fix: Minor updates to the files generated by `nesta plugin:create`.
+
+ * Bug fix: Don't allow retrieval of the contents of any file
+   within the content folder by crafting a relative path containing
+   the string '../' (Louis Nyffenegger).
+
 = 0.9.10 / (9 September 2011)
 
  * Load Nesta plugins from gems. Any gem whose name begins with

data/Gemfile.lock

@@ -1,10 +1,10 @@
 PATH
   remote: .
   specs:
-    nesta (0.9.10)
+    nesta (0.9.11)
       RedCloth (~> 4.2)
       haml (~> 3.1)
-      maruku (>= 0.6.0)
+      rdiscount (~> 1.6)
       sass (~> 3.1)
       shotgun (>= 0.8)
       sinatra (= 1.2.6)
@@ -13,16 +13,15 @@ GEM
   remote: http://rubygems.org/
   specs:
     RedCloth (4.2.8)
-    haml (3.1.2)
+    haml (3.1.3)
     hoe (2.12.2)
       rake (~> 0.8)
     hpricot (0.8.4)
-    maruku (0.6.0)
-      syntax (>= 1.0.0)
     rack (1.3.2)
     rack-test (0.6.1)
       rack (>= 1.0)
     rake (0.9.2)
+    rdiscount (1.6.8)
     rspec (1.3.0)
     rspec_hpricot_matchers (1.0)
     sass (3.1.7)
@@ -31,7 +30,6 @@ GEM
     sinatra (1.2.6)
       rack (~> 1.1)
       tilt (< 2.0, >= 1.2.2)
-    syntax (1.0.0)
     test-unit (1.2.3)
       hoe (>= 1.5.1)
     tilt (1.3.3)

data/lib/nesta.rb

@@ -0,0 +1 @@
+require "nesta/plugin"

data/lib/nesta/app.rb

@@ -100,6 +100,16 @@ module Nesta
       def article_summaries(articles)
         haml(:summaries, :layout => false, :locals => { :pages => articles })
       end
+
+      def articles_heading
+        @page.metadata('articles heading') || "Articles on #{@page.heading}"
+      end
+    end
+
+    before do
+      if request.path =~ Regexp.new('./$')
+        redirect to(request.path.sub(Regexp.new('/$'), ''))
+      end
     end
 
     not_found do
@@ -128,9 +138,13 @@ module Nesta
       cache stylesheet(params[:sheet].to_sym)
     end
 
-    get %r{/attachments/([\w/.-]+)} do
+    get %r{/attachments/([\w/.-]+)} do |file|
       file = File.join(Nesta::Config.attachment_path, params[:captures].first)
-      send_file(file, :disposition => nil)
+      if file =~ /\.\.\//
+        not_found
+      else 
+        send_file(file, :disposition => nil)
+      end
     end
 
     get '/articles.xml' do

data/lib/nesta/commands.rb

@@ -166,9 +166,7 @@ module Nesta
   module Plugin
     module #{module_name}
       module Helpers
-        helpers do
-          # If your plugin needs any helper methods, add them here...
-        end 
+        # If your plugin needs any helper methods, add them here...
       end
     end
   end
@@ -182,13 +180,19 @@ end
         end
 
         def specify_gem_dependency
-          File.open(File.join(@gem_name, "#{@gem_name}.gemspec"), 'r+') do |file|
+          gemspec = File.join(@gem_name, "#{@gem_name}.gemspec")
+          File.open(gemspec, 'r+') do |file|
+            output = ''
             file.each_line do |line|
-              if line =~ /specify any dependencies here/
-                file.puts('  s.add_dependency("nesta", ">= 0.9.10")')
-                file.puts('  s.add_development_dependency("rake")')
+              if line =~ /^end/
+                output << '  s.add_dependency("nesta", ">= 0.9.11")' + "\n"
+                output << '  s.add_development_dependency("rake")' + "\n"
               end
+              output << line
             end
+            file.pos = 0
+            file.print(output)
+            file.truncate(file.pos)
           end
         end
 

data/lib/nesta/models.rb

@@ -1,8 +1,10 @@
-require "time"
+require 'time'
 
-require "rubygems"
-require "maruku"
-require "redcloth"
+Tilt.register Tilt::MarukuTemplate, 'mdown'
+Tilt.register Tilt::KramdownTemplate, 'mdown'
+Tilt.register Tilt::BlueClothTemplate, 'mdown'
+Tilt.register Tilt::RDiscountTemplate, 'mdown'
+Tilt.register Tilt::RedcarpetTemplate, 'mdown'
 
 module Nesta
   class FileModel
@@ -11,6 +13,12 @@ module Nesta
 
     attr_reader :filename, :mtime
 
+    class CaseInsensitiveHash < Hash
+      def [](key)
+        super(key.to_s.downcase)
+      end
+    end
+
     def self.model_path(basename = nil)
       Nesta::Config.content_path(basename)
     end
@@ -51,7 +59,7 @@ module Nesta
 
     def initialize(filename)
       @filename = filename
-      @format = filename.split(".").last.to_sym
+      @format = filename.split('.').last.to_sym
       if File.zero?(filename)
         @metadata = {}
         @markup = ''
@@ -83,11 +91,11 @@ module Nesta
     end
 
     def layout
-      (metadata("layout") || "layout").to_sym
+      (metadata('layout') || 'layout').to_sym
     end
 
     def template
-      (metadata("template") || "page").to_sym
+      (metadata('template') || 'page').to_sym
     end
 
     def to_html(scope = nil)
@@ -99,11 +107,11 @@ module Nesta
     end
 
     def description
-      metadata("description")
+      metadata('description')
     end
 
     def keywords
-      metadata("keywords")
+      metadata('keywords')
     end
     
     def metadata(key)
@@ -111,8 +119,8 @@ module Nesta
     end
 
     def flagged_as?(flag)
-      flags = metadata("flags")
-      flags && flags.split(",").map { |name| name.strip }.include?(flag)
+      flags = metadata('flags')
+      flags && flags.split(',').map { |name| name.strip }.include?(flag)
     end
 
     private
@@ -130,7 +138,7 @@ module Nesta
         raise Sinatra::NotFound
       else
         first_paragraph, remaining = contents.split(/\r?\n\r?\n/, 2)
-        metadata = {}
+        metadata = CaseInsensitiveHash.new
         if metadata?(first_paragraph)
           first_paragraph.split("\n").each do |line|
             key, value = line.split(/\s*:\s*/, 2)
@@ -142,14 +150,8 @@ module Nesta
       end
 
       def convert_to_html(format, scope, text)
-        case format
-          when :mdown
-            Maruku.new(text).to_html
-          when :haml
-            Haml::Engine.new(text).to_html(scope)
-          when :textile
-            RedCloth.new(text).to_html
-          end
+        template = Tilt[format].new { text }
+        template.render(scope)
       end
   end
 
@@ -231,23 +233,18 @@ module Nesta
     def summary
       if summary_text = metadata("summary")
         summary_text.gsub!('\n', "\n")
-        case @format
-        when :textile
-          RedCloth.new(summary_text).to_html
-        else
-          Maruku.new(summary_text).to_html
-        end
+        convert_to_html(@format, nil, summary_text)
       end
     end
 
     def body(scope = nil)
       body_text = case @format
         when :mdown
-          markup.sub(/^#[^#].*$\r?\n(\r?\n)?/, "")
+          markup.sub(/^#[^#].*$\r?\n(\r?\n)?/, '')
         when :haml
-          markup.sub(/^\s*%h1\s+.*$\r?\n(\r?\n)?/, "")
+          markup.sub(/^\s*%h1\s+.*$\r?\n(\r?\n)?/, '')
         when :textile
-          markup.sub(/^\s*h1\.\s+.*$\r?\n(\r?\n)?/, "")
+          markup.sub(/^\s*h1\.\s+.*$\r?\n(\r?\n)?/, '')
         end
       convert_to_html(@format, scope, body_text)
     end

data/lib/nesta/version.rb

@@ -1,3 +1,3 @@
 module Nesta
-  VERSION = '0.9.10'
+  VERSION = '0.9.11'
 end

data/nesta.gemspec

@@ -33,7 +33,7 @@ EOF
 
   s.add_dependency('haml', '~> 3.1')
   s.add_dependency('sass', '~> 3.1')
-  s.add_dependency('maruku', '>= 0.6.0')
+  s.add_dependency('rdiscount', '~> 1.6')
   s.add_dependency('RedCloth', '~> 4.2')
   s.add_dependency('sinatra', '1.2.6')
   

data/spec/atom_spec.rb

@@ -100,7 +100,8 @@ describe "atom feed" do
     end
     
     it "should include hostname in URLs" do
-      body.should have_tag("entry/content", /href='http:\/\/example.org\/foo/)
+      body.should have_tag("entry/content",
+                           Regexp.new('href=.+http:\/\/example.org\/foo'))
     end
     
     it "should not include article heading in content" do

data/spec/commands_spec.rb

@@ -207,6 +207,7 @@ describe "nesta" do
         @init_file = create_gem_file('lib', @gem_name, 'init.rb')
         @gem_spec = create_gem_file("#{@gem_name}.gemspec") do |file|
           file.puts "  # specify any dependencies here; for example:"
+          file.puts "end"
         end
       end
 
@@ -226,7 +227,6 @@ describe "nesta" do
         boilerplate = <<-EOF
     module My::Feature
       module Helpers
-        helpers do
         EOF
         init.should include(boilerplate)
         init.should include('helpers Nesta::Plugin::My::Feature::Helpers')
@@ -235,7 +235,7 @@ describe "nesta" do
       it "should specify plugin gem's dependencies" do
         @command.execute
         text = File.read(@gem_spec)
-        text.should include('s.add_dependency("nesta", ">= 0.9.10")')
+        text.should include('s.add_dependency("nesta", ">= 0.9.11")')
         text.should include('s.add_development_dependency("rake")')
       end
     end

data/spec/models_spec.rb

@@ -311,7 +311,7 @@ describe "Page", :shared => true do
         file = File.open(path, 'w')
         file.close
       end
-      Nesta::Page.find_all.first.to_html.should == ''
+      Nesta::Page.find_all.first.to_html.should match(/^\s*$/)
     end
   end
 

data/spec/page_spec.rb

@@ -288,19 +288,21 @@ describe "A page" do
       last_response.should_not be_ok
     end
   end
-  
+
   describe "that has meta data" do
     before(:each) do
       @title = 'Different title'
       @content = "Page content"
       @description = "Page about stuff"
       @keywords = "things, stuff"
+      @articles_heading = "Posts about this stuff"
       @category = create_category(
         :content => "# My category\n\n#{@content}",
         :metadata => {
           'title' => @title,
           'description' => @description,
-          'keywords' => @keywords
+          'keywords' => @keywords,
+          'articles heading' => @articles_heading
         }
       )
     end
@@ -308,11 +310,18 @@ describe "A page" do
     it_should_behave_like "page with keyword and description"
     it_should_behave_like "page that can display menus"
 
+    describe "whose URL ends in /" do
+      it "should be redirected, removing the slash" do
+        get @category.abspath + '/'
+        last_response.should be_redirect
+      end
+    end
+
     it "should render successfully" do
       do_get
       last_response.should be_ok
     end
-    
+
     it "should display the heading" do
       do_get
       body.should have_tag('h1', @category.heading)
@@ -371,6 +380,11 @@ describe "A page" do
             "h1 a[@href='#{@article.abspath}']", /^\s*#{@article.heading}$/)
         body.should_not have_tag("h3", @article2.heading)
       end
+
+      it "should display the article heading" do
+        do_get
+        body.should have_tag('h1', @articles_heading)
+      end
     end
 
     it "should not include Disqus comments by default" do
@@ -438,32 +452,47 @@ describe "attachments" do
   include ModelFactory
   include RequestSpecHelper
 
-  def create_attachment
+  before(:each) do
     stub_configuration
     create_content_directories
-    path = File.join(Nesta::Config.attachment_path, "test.txt")
-    File.open(path, "w") { |file| file.write("I'm a test attachment") }
   end
-  
-  before(:each) do
-    create_attachment
-    get "/attachments/test.txt"
-  end
-  
+
   after(:each) do
     remove_temp_directory
     Nesta::FileModel.purge_cache
   end
-  
-  it "should be served successfully" do
-    last_response.should be_ok
-  end
-  
-  it "should be sent to the client" do
-    body.should include("I'm a test attachment")
+    
+  describe "in the attachments folder" do
+    before(:each) do
+      path = File.join(Nesta::Config.attachment_path, 'test.txt')
+      File.open(path, 'w') { |file| file.write("I'm a test attachment") }
+    end
+    
+    it "should be served successfully" do
+      get "/attachments/test.txt"
+      last_response.should be_ok
+    end
+    
+    it "should be sent to the client" do
+      get "/attachments/test.txt"
+      body.should include("I'm a test attachment")
+    end
+    
+    it "should set the appropriate MIME type" do
+      get "/attachments/test.txt"
+      last_response.headers["Content-Type"].should =~ Regexp.new("^text/plain")
+    end
   end
-  
-  it "should set the appropriate MIME type" do
-    last_response.headers["Content-Type"].should =~ Regexp.new("^text/plain")
+
+  describe "outside the attachments folder" do
+    before(:each) do
+      path = File.join(Nesta::Config.page_path, 'index.haml')
+      File.open(path, 'w') { |file| file.write('%h1 Test page') }
+    end
+
+    it "should be directory traversal free" do
+      get '/attachments/../pages/index.haml'
+      last_response.should_not be_ok
+    end
   end
 end

data/views/page.haml

@@ -11,7 +11,7 @@
     - unless @page.articles.empty?
       %section.articles
         %header
-          %h1= "Articles on #{@page.heading}"
+          %h1= articles_heading
         = article_summaries(@page.articles)
 
     = haml :page_meta, :layout => false, :locals => { :page => @page }

metadata

@@ -1,8 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: nesta
 version: !ruby/object:Gem::Version 
+  hash: 45
   prerelease: 
-  version: 0.9.10
+  segments: 
+  - 0
+  - 9
+  - 11
+  version: 0.9.11
 platform: ruby
 authors: 
 - Graham Ashton
@@ -10,130 +15,179 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2011-09-09 00:00:00 +01:00
+date: 2011-09-22 00:00:00 +01:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
-  name: haml
   requirement: &id001 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
+        hash: 5
+        segments: 
+        - 3
+        - 1
         version: "3.1"
-  type: :runtime
-  prerelease: false
   version_requirements: *id001
+  name: haml
+  prerelease: false
+  type: :runtime
 - !ruby/object:Gem::Dependency 
-  name: sass
   requirement: &id002 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
+        hash: 5
+        segments: 
+        - 3
+        - 1
         version: "3.1"
-  type: :runtime
-  prerelease: false
   version_requirements: *id002
+  name: sass
+  prerelease: false
+  type: :runtime
 - !ruby/object:Gem::Dependency 
-  name: maruku
   requirement: &id003 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
-    - - ">="
+    - - ~>
       - !ruby/object:Gem::Version 
-        version: 0.6.0
-  type: :runtime
-  prerelease: false
+        hash: 3
+        segments: 
+        - 1
+        - 6
+        version: "1.6"
   version_requirements: *id003
+  name: rdiscount
+  prerelease: false
+  type: :runtime
 - !ruby/object:Gem::Dependency 
-  name: RedCloth
   requirement: &id004 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
+        hash: 31
+        segments: 
+        - 4
+        - 2
         version: "4.2"
-  type: :runtime
-  prerelease: false
   version_requirements: *id004
+  name: RedCloth
+  prerelease: false
+  type: :runtime
 - !ruby/object:Gem::Dependency 
-  name: sinatra
   requirement: &id005 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - "="
       - !ruby/object:Gem::Version 
+        hash: 19
+        segments: 
+        - 1
+        - 2
+        - 6
         version: 1.2.6
-  type: :runtime
-  prerelease: false
   version_requirements: *id005
+  name: sinatra
+  prerelease: false
+  type: :runtime
 - !ruby/object:Gem::Dependency 
-  name: shotgun
   requirement: &id006 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
+        hash: 27
+        segments: 
+        - 0
+        - 8
         version: "0.8"
-  type: :runtime
-  prerelease: false
   version_requirements: *id006
+  name: shotgun
+  prerelease: false
+  type: :runtime
 - !ruby/object:Gem::Dependency 
-  name: hpricot
   requirement: &id007 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - "="
       - !ruby/object:Gem::Version 
+        hash: 55
+        segments: 
+        - 0
+        - 8
+        - 4
         version: 0.8.4
-  type: :development
-  prerelease: false
   version_requirements: *id007
+  name: hpricot
+  prerelease: false
+  type: :development
 - !ruby/object:Gem::Dependency 
-  name: rack-test
   requirement: &id008 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - "="
       - !ruby/object:Gem::Version 
+        hash: 5
+        segments: 
+        - 0
+        - 6
+        - 1
         version: 0.6.1
-  type: :development
-  prerelease: false
   version_requirements: *id008
+  name: rack-test
+  prerelease: false
+  type: :development
 - !ruby/object:Gem::Dependency 
-  name: rspec
   requirement: &id009 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - "="
       - !ruby/object:Gem::Version 
+        hash: 27
+        segments: 
+        - 1
+        - 3
+        - 0
         version: 1.3.0
-  type: :development
-  prerelease: false
   version_requirements: *id009
+  name: rspec
+  prerelease: false
+  type: :development
 - !ruby/object:Gem::Dependency 
-  name: rspec_hpricot_matchers
   requirement: &id010 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - "="
       - !ruby/object:Gem::Version 
+        hash: 15
+        segments: 
+        - 1
+        - 0
         version: "1.0"
-  type: :development
-  prerelease: false
   version_requirements: *id010
+  name: rspec_hpricot_matchers
+  prerelease: false
+  type: :development
 - !ruby/object:Gem::Dependency 
-  name: test-unit
   requirement: &id011 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - "="
       - !ruby/object:Gem::Version 
+        hash: 25
+        segments: 
+        - 1
+        - 2
+        - 3
         version: 1.2.3
-  type: :development
-  prerelease: false
   version_requirements: *id011
+  name: test-unit
+  prerelease: false
+  type: :development
 description: |
   Nesta is a lightweight Content Management System, written in Ruby using
   the Sinatra web framework. Nesta has the simplicity of a static site
@@ -166,6 +220,7 @@ files:
 - bin/nesta
 - config.ru
 - config/deploy.rb.sample
+- lib/nesta.rb
 - lib/nesta/app.rb
 - lib/nesta/cache.rb
 - lib/nesta/commands.rb
@@ -238,7 +293,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements: 
   - - ">="
     - !ruby/object:Gem::Version 
-      hash: 279403347508023079
+      hash: 3
       segments: 
       - 0
       version: "0"
@@ -247,7 +302,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
   requirements: 
   - - ">="
     - !ruby/object:Gem::Version 
-      hash: 279403347508023079
+      hash: 3
       segments: 
       - 0
       version: "0"