tdiary 3.2.2.20130507

data/tdiary/author_only_base.rb

@@ -0,0 +1,171 @@
+module TDiary
+	#
+	# class TDiaryAuthorOnlyBase
+	#  base class for author-only access pages
+	#
+	class TDiaryAuthorOnlyBase < TDiaryBase
+		def csrf_protection_get_is_okay; false; end
+
+		def initialize( cgi, rhtml, conf )
+			super
+			csrf_check( cgi, conf )
+		end
+
+	private
+
+		def csrf_check( cgi, conf )
+			# CSRF condition check
+			protection_method = conf.options['csrf_protection_method']
+			masterkey = conf.options['csrf_protection_key']
+			updaterb_regexp = conf.options['csrf_protection_allowed_referer_regexp_for_update']
+
+			protection_method = 1 unless protection_method
+
+			return if protection_method == -1 # don't use this setting!
+
+			check_key = (protection_method & 2 != 0)
+			check_referer = (protection_method & 1 != 0)
+
+			masterkey = '' unless masterkey
+
+			updaterb_regexp = '' unless updaterb_regexp
+
+			if (masterkey != '' && check_key)
+				@csrf_protection = %Q[<input type="hidden" name="csrf_protection_key" value="#{h masterkey}">]
+			else
+				@csrf_protection="<!-- no CSRF protection key used -->"
+			end
+
+			referer = cgi.referer || ''
+			referer = referer.sub(/\?.*$/, '')
+			base_uri = URI.parse(base_url)
+			config_uri = URI.parse(base_url) + conf.update
+
+			referer_is_empty = referer == ''
+			referer_uri = URI.parse(referer) if !referer_is_empty
+			referer_is_config = !referer_is_empty && config_uri == referer_uri
+			referer_is_config ||= Regexp.new(updaterb_regexp) =~ referer if !referer_is_empty && updaterb_regexp != ''
+			is_post = cgi.request_method == 'POST'
+
+			given_key = nil
+			if cgi.valid?('csrf_protection_key')
+				given_key = cgi.params['csrf_protection_key'][0]
+				case given_key
+				when String
+				else
+					given_key = given_key.read
+				end
+			end
+
+			is_key_ok = masterkey != '' && given_key == masterkey
+
+			keycheck_ok = !check_key || is_key_ok
+			referercheck_ok = referer_is_config || (!check_referer && referer_is_empty)
+
+			if csrf_protection_get_is_okay then
+				return if is_post || given_key == nil
+			else
+				return if keycheck_ok && referercheck_ok
+			end
+
+			raise Exception.new(<<"EOS")
+Security Error: Possible Cross-site Request Forgery (CSRF)
+
+        Diagnostics:
+                - Protection Method is #{ protection_method }
+                - Mode is #{ self.mode || 'unknown' }
+                    - GET is #{ csrf_protection_get_is_okay ? '' : 'not '}allowed
+                - Request Method is #{ is_post ? 'POST' : 'not POST' }
+                - Referer is #{ referer_is_empty ? 'empty' : referer_is_config ? 'config' : 'another page' }
+                    - Given referer:       #{h referer_uri.to_s}
+                    - Expected base URI:   #{h base_uri.to_s}
+                    - Expected update URI: #{h config_uri.to_s}
+                - CSRF key is #{ is_key_ok ? 'OK' : given_key ? 'NG (' + (given_key || '') + ')' : 'nothing' }
+EOS
+		end
+
+		def load_plugins
+			super
+			@plugin.instance_eval("def csrf_protection\n#{(@csrf_protection.untaint || '').dump}\nend;")
+		end
+	end
+
+	#
+	# class TDiaryFormPlugin
+	#  show edit diary form after calling form plugin.
+	#
+	class TDiaryFormPlugin < TDiaryAuthorOnlyBase
+		def initialize( cgi, rhtm, conf )
+			super
+
+			if @cgi.valid?( 'date' ) then
+				if @cgi.params['date'][0].kind_of?( String ) then
+					date = @cgi.params['date'][0]
+				else
+					date = @cgi.params['date'][0].read
+				end
+				@date = Time::local( *date.scan( /(\d{4})(\d\d)(\d\d)/ )[0] )
+			else
+				@date = Time::now + (@conf.hour_offset * 3600).to_i
+				@diary = @io.diary_factory( @date, '', '', @conf.style )
+			end
+
+			@io.transaction( @date ) do |diaries|
+				@diaries = diaries
+				@diary = self[@date]
+				if @diary then
+					@conf.style = @diary.style
+				else
+					@diary =  @io.diary_factory( @date, '', '', @conf.style )
+				end
+				DIRTY_NONE
+			end
+		end
+	end
+
+	#
+	# class TDiaryConf
+	#  show configuration form
+	#
+	class TDiaryConf < TDiaryAuthorOnlyBase
+		def csrf_protection_get_is_okay; true; end
+
+		def initialize( cgi, rhtml, conf )
+			super
+			@key = @cgi.params['conf'][0] || ''
+		end
+	end
+
+	#
+	# class TDiarySaveConf
+	#  save configuration
+	#
+	class TDiarySaveConf < TDiaryConf
+		def csrf_protection_get_is_okay; false; end
+
+		def initialize( cgi, rhtml, conf )
+			super
+		end
+
+		def eval_rhtml( prefix = '' )
+			r = super
+
+			begin
+				@conf.save
+				@io.clear_cache
+			rescue
+				@error = [$!.dup, $@.dup]
+			end
+
+			r
+		end
+	end
+end
+
+# Local Variables:
+# mode: ruby
+# indent-tabs-mode: t
+# tab-width: 3
+# ruby-indent-level: 3
+# End:
+# vim: ts=3

data/tdiary/base.rb

@@ -0,0 +1,220 @@
+# -*- coding: utf-8 -*-
+module TDiary
+	#
+	# class TDiaryBase
+	#  tDiary CGI
+	#
+	class TDiaryBase
+		include ERB::Util
+		include ViewHelper
+
+		DIRTY_NONE = 0
+		DIRTY_DIARY = 1
+		DIRTY_COMMENT = 2
+		DIRTY_REFERER = 4
+
+		attr_reader :cookies, :date, :diaries
+		attr_reader :cgi, :rhtml, :conf
+		attr_reader :ignore_parser_cache
+
+		def initialize( cgi, rhtml, conf )
+			@cgi, @rhtml, @conf = cgi, rhtml, conf
+			@diaries = {}
+			@cookies = []
+			@io = @conf.io_class.new( self )
+			@ignore_parser_cache = false
+		end
+
+		def eval_rhtml( prefix = '' )
+			begin
+				r = do_eval_rhtml( prefix )
+			rescue PluginError, SyntaxError, ArgumentError, Exception => e
+				if e.class == ForceRedirect
+					raise
+				else
+					body = File.read("#{PATH}/skel/plugin_error.rhtml").untaint
+					r = ERB.new(body).result(binding)
+				end
+			end
+			r
+		end
+
+		def last_modified
+			nil
+		end
+
+		def []( date )
+			@diaries[date.strftime( '%Y%m%d' )]
+		end
+
+		def calendar
+			@years = @io.calendar unless @years
+		end
+
+	protected
+
+		def do_eval_rhtml( prefix )
+			load_plugins
+
+			r = @io.restore_cache( prefix )
+
+			if r.nil?
+				r = @rhtml ? erb_src(prefix) : ""
+				@io.store_cache( r, prefix ) unless @diaries.empty?
+			end
+
+			r = @plugin.eval_src( r.untaint, @conf.secure ) if @plugin
+
+			@cookies += @plugin.cookies
+
+			r
+		end
+
+		def mode
+			self.class.to_s.sub( /^TDiary::TDiary/, '' ).downcase
+		end
+
+		def load_plugins
+			calendar
+			#
+			# caching plugin
+			# NOTE: currently, plugin cache doesn't work with blog-category plugin
+			#       see also https://github.com/tdiary/tdiary-core/issues/203
+			#
+			if @plugin and not @plugin.respond_to?( 'blog_category' )
+				@plugin.diaries = @diaries
+				@plugin.date = @date
+				@plugin.last_modified = last_modified
+				@plugin.comment = @comment
+				@plugin
+			else
+				@plugin = Plugin::new(
+					'conf' => @conf,
+					'mode' => mode,
+					'diaries' => @diaries,
+					'cgi' => @cgi,
+					'years' => @years,
+					'cache_path' => @io.cache_path,
+					'date' => @date,
+					'comment' => @comment,
+					'last_modified' => last_modified,
+					'logger' => TDiary.logger
+				)
+			end
+		end
+
+		def <<( diary )
+			@diaries[diary.date.strftime( '%Y%m%d' )] = diary
+		end
+
+		def delete( date )
+			@diaries.delete( date.strftime( '%Y%m%d' ) )
+		end
+
+	private
+
+		def erb_src(prefix)
+			rhtml = ["header.rhtml", @rhtml, "footer.rhtml"].map do |file|
+				path = "#{PATH}/skel/#{prefix}#{file}"
+				begin
+					File.read("#{path}.#{@conf.lang}")
+				rescue
+					File.read(path)
+				end
+			end.join
+
+			begin
+				r = ERB.new(rhtml.untaint).result(binding)
+			rescue => e
+				# migration error on ruby 1.9 only 1st time, reload.
+				if defined?(::Encoding) && e.class == ::Encoding::CompatibilityError
+					raise ForceRedirect.new(base_url)
+				end
+			end
+			ERB.new(r).src
+		end
+	end
+
+	#
+	# class TDiaryCategoryView
+	#  base of category view mode classes
+	#
+	class TDiaryCategoryView < TDiaryBase
+		attr_reader :last_modified
+
+		def initialize(cgi, rhtml, conf)
+			super
+			@last_modified = Time.now
+		end
+	end
+
+	#
+	# class TDiarySearch
+	#  base of search view mode classes
+	#
+	class TDiarySearch < TDiaryBase
+		attr_reader :last_modified
+
+		def initialize(cgi, rhtml, conf)
+			super
+			@last_modified = Time.now
+		end
+	end
+
+	# class TDiaryPluginView
+	#  base of plugin view mode classes
+	#
+	class TDiaryPluginView < TDiaryBase
+		attr_reader :last_modified
+
+		def initialize(cgi, rhtml, conf)
+			super
+
+			tdiary = tdiary_class(cgi.params['date'][0] || '').new(cgi, '', conf)
+			@date = tdiary.date
+			@diaries = tdiary.diaries
+			@last_modified = Time.now
+		end
+
+		def eval_rhtml( prefix = '' )
+			load_plugins
+			# TODO: prefixでモバイルモードかどうかを判定
+			# TODO: rhtml rendering
+			@rhtml = "#{plugin_name}.rhtml"
+			@plugin.__send__(:content_proc, plugin_name, @date.strftime('%Y%m%d'))
+		end
+
+		protected
+
+		def plugin_name
+			# plugin name MUST contain only words ([a-zA-Z0-9_])
+			@plugin_name ||= (@cgi.params['plugin'][0] || '').match(/^(\w+)$/).to_a[1]
+			raise TDiary::PermissionError.new('invalid plugin name') unless @plugin_name
+			@plugin_name
+		end
+
+		def tdiary_class(date)
+			# YYYYMMDD-N, YYYYMMDD, YYYYMM, MMDD, or nil
+			case date
+			when /^\d{8}-\d+$/
+				TDiaryLatest
+			when /^\d{8}$/
+				TDiaryDay
+			when /^\d{6}$/
+				TDiaryMonth
+			when /^\d{4}$/
+				TDiaryNYear
+			else
+				TDiaryLatest
+			end
+		end
+	end
+end
+
+# Local Variables:
+# mode: ruby
+# indent-tabs-mode: t
+# tab-width: 3
+# ruby-indent-level: 3
+# End:
+# vim: ts=3

data/tdiary/cli.rb

@@ -0,0 +1,116 @@
+# coding: utf-8
+require 'thor'
+require 'tdiary'
+require 'bundler'
+
+module TDiary
+	class CLI < Thor
+		include Thor::Actions
+
+		def self.source_root
+			TDiary.root
+		end
+
+		desc "new DIR_NAME", "Create a new tDiary directory"
+		def new(name)
+			target = File.join(Dir.pwd, name)
+			deploy(target)
+
+			Bundler.with_clean_env do
+				inside(target) do
+					run('bundle install --without test development')
+					run('bundle exec tdiary htpasswd')
+				end
+			end
+			say 'install finished', :green
+			say "run `tdiary server` in #{name} directory to start server", :green
+		end
+
+		desc "test", "Create test server and run tDiary test"
+		def test
+			target = File.join(Dir.pwd, 'tmp/test')
+			deploy(target)
+			append_to_file(File.join(target, 'Gemfile'), "path '#{TDiary.root}'")
+			directory('spec', File.join(target, 'spec'))
+			directory('test', File.join(target, 'test'))
+
+			Bundler.with_clean_env do
+				inside(target) do
+					run('bundle install')
+					run('bundle exec rake spec')
+				end
+			end
+		end
+
+		desc "server", "Start tDiary server"
+		method_option "rack", :type => :string, :banner =>
+			"start server with rack interface (default)"
+		method_option "cgi", :type => :string, :banner =>
+			"start server with cgi interface"
+		def server
+			if options[:cgi]
+				opts = {
+					:daemon => ENV['DAEMON'],
+					:bind   => ENV['BIND'] || '0.0.0.0',
+					:port   => ENV['PORT'] || 19292,
+					:logger => $stderr,
+					:access_log => $stderr,
+				}
+				TDiary::Server.run( opts )
+			elsif
+				# --rack option
+				# TODO: start rack server without run command
+				run 'bundle exec rackup'
+			end
+		end
+
+		desc "htpasswd", "Create a .htpasswd file"
+		def htpasswd
+			require 'webrick/httpauth/htpasswd'
+			say "Input your username/password"
+			print 'Username: '
+			ARGV.replace([])
+			username = gets().chop
+			print 'New password: '
+			system "stty -echo"
+			password = $stdin.gets.chop
+			puts
+			print 'Re-type new password: '
+			password2 = $stdin.gets.chop
+			puts
+			system "stty echo"
+			if password != password2
+				raise StandardError, 'password verification error'
+			end
+			htpasswd = WEBrick::HTTPAuth::Htpasswd.new('.htpasswd')
+			htpasswd.set_passwd(nil, username, password)
+			htpasswd.flush
+		end
+
+		desc "version", "Prints the tDiary's version information"
+		def version
+			say "tdiary #{TDiary::VERSION}"
+		end
+		map %w(-v --version) => :version
+
+		no_commands do
+			def deploy(target)
+				empty_directory(target)
+				empty_directory(File.join(target, 'public'))
+				empty_directory(File.join(target, 'misc/plugin'))
+				%w(
+				README.md
+				Gemfile
+				config.ru
+				tdiary.conf.beginner
+				tdiary.conf.sample
+				tdiary.conf.sample-en
+				).each do |file|
+					copy_file(file, File.join(target, file))
+				end
+				copy_file('tdiary.conf.beginner', File.join(target, 'tdiary.conf'))
+				directory('doc', File.join(target, 'doc'))
+			end
+		end
+	end
+end