typo 3.99.0

data/lib/spam_protection.rb

@@ -0,0 +1,126 @@
+class SpamProtection
+
+  IP_RBLS = [ 'opm.blitzed.us', 'bsb.empty.us' ]
+  HOST_RBLS = [ 'multi.surbl.org', 'bsb.empty.us' ]
+  SECOND_LEVEL = [ 'co', 'com', 'net', 'org', 'gov' ]
+
+  attr_accessor :this_blog
+
+  def initialize(a_blog)
+    self.this_blog = a_blog
+  end
+
+  def article_closed?(record)
+    return false if this_blog.sp_article_auto_close.zero? or not record.new_record?
+
+    if record.article.created_at.to_i < this_blog.sp_article_auto_close.days.ago.to_i
+      logger.info("[SP] Blocked interaction with #{record.article.title}")
+      return true
+    end
+  end
+
+  def is_spam?(string)
+    return false unless this_blog.sp_global
+    return false if string.blank?
+
+    reason = catch(:hit) do
+      case string
+        when Format::IP_ADDRESS: self.scan_ip(string)
+        when Format::HTTP_URI: self.scan_uri(URI.parse(string).host) rescue URI::InvalidURIError
+        else self.scan_text(string)
+      end
+    end
+
+    if reason
+      logger.info("[SP] Hit: #{reason}")
+      return true
+    end
+  end
+
+  protected
+
+  def scan_ip(ip_address)
+    logger.info("[SP] Scanning IP #{ip_address}")
+    query_rbls(IP_RBLS, ip_address.split('.').reverse.join('.'))
+  end
+
+  def scan_text(string)
+    # Scan contained URLs
+    uri_list = string.scan(/(http:\/\/[^\s"]+)/m).flatten
+
+    # Check for URL count limit
+    if this_blog.sp_url_limit > 0
+      throw :hit, "Hard URL Limit hit: #{uri_list.size} > #{this_blog.sp_url_limit}" if uri_list.size > this_blog.sp_url_limit
+    end
+
+    uri_list.collect { |uri| URI.parse(uri).host rescue nil }.uniq.compact.each do |host|
+      scan_uri(host)
+    end
+
+    # Pattern scanning
+    BlacklistPattern.find_all.each do |pattern|
+      logger.info("[SP] Scanning for #{pattern.class} #{pattern.pattern}")
+
+      throw :hit, "#{pattern} matched" if pattern.matches?(string)
+    end
+
+    return false
+  end
+
+  def scan_uri(host)
+    return scan_ip(host) if host =~ Format::IP_ADDRESS
+
+    host_parts = host.split('.').reverse
+    domain = Array.new
+
+    # Check for two level TLD
+    (SECOND_LEVEL.include?(host_parts[1]) ? 3:2).times do
+      domain.unshift(host_parts.shift)
+    end
+
+    logger.info("[SP] Scanning domain #{domain.join('.')}")
+    query_rbls(HOST_RBLS, host, domain.join('.'))
+  end
+
+  def query_rbls(rbls, *subdomains)
+    rbls.each do |rbl|
+      subdomains.uniq.each do |d|
+        begin
+          response = IPSocket.getaddress([d, rbl].join('.'))
+          throw :hit, "#{rbl} positively resolved subdomain #{d} => #{response}" if response =~ /^127\.0\.0\./
+        rescue SocketError
+          # NXDOMAIN response => negative:  d is not in RBL
+        end
+      end
+    end
+    return false
+  end
+
+  def logger
+    @logger ||= RAILS_DEFAULT_LOGGER || Logger.new(STDOUT)
+  end
+end
+
+module ActiveRecord
+  module Validations
+    module ClassMethods
+      def validates_against_spamdb(*attr_names)
+        configuration = { :message => "blocked by SpamProtection" }
+        configuration.update(attr_names.pop) if attr_names.last.is_a?(Hash)
+
+        validates_each(attr_names, configuration) do |record, attr_name, value|
+          record.errors.add(attr_name, configuration[:message]) if SpamProtection.new(record.blog).is_spam?(value)
+        end
+      end
+      def validates_age_of(*attr_names)
+        configuration = { :on => :create, :message => "points to an item that is no longer available for interaction"}
+        configuration.update(attr_names.pop) if attr_names.last.is_a?(Hash)
+
+        validates_each(attr_names, configuration) do |record, attr_name, value|
+          next unless value.to_i > 0
+          record.errors.add(attr_name, configuration[:message]) if SpamProtection.new(record.blog).article_closed?(record)
+        end
+      end
+    end
+  end
+end

data/lib/tasks/release.rake

@@ -0,0 +1,171 @@
+require 'rake/gempackagetask'
+require 'rake/contrib/rubyforgepublisher'
+
+PKG_VERSION = "3.99.0"
+PKG_NAME = "typo"
+PKG_FILE_NAME = "#{PKG_NAME}-#{PKG_VERSION}"
+RUBY_FORGE_PROJECT = 'typo'
+RUBY_FORGE_USER = 'scottlaird'
+RELEASE_NAME = "#{PKG_NAME}-#{PKG_VERSION}"
+
+spec = Gem::Specification.new do |s|
+  s.name = PKG_NAME
+  s.version = PKG_VERSION
+  s.summary = "Modern weblog engine."
+  s.has_rdoc = false
+  
+  s.files = Dir.glob('**/*', File::FNM_DOTMATCH).reject do |f| 
+     [ /\.$/, /sqlite$/, /\.log$/, /^pkg/, /\.svn/, /^vendor\/rails/, 
+     /^public\/(files|xml|articles|pages|index.html)/, 
+     /^public\/(stylesheets|javascripts|images)\/theme/, /\~$/, 
+     /\/\._/, /\/#/ ].any? {|regex| f =~ regex }
+  end
+  s.require_path = '.'
+  s.author = "Tobias Luetke"
+  s.email = "tobi@leetsoft.com"
+  s.homepage = "http://www.typosphere.org"  
+  s.rubyforge_project = "typo"
+  s.platform = Gem::Platform::RUBY 
+  s.executables = ['typo']
+  
+  s.add_dependency("rails", "= 1.1.4")
+  s.add_dependency("mongrel", ">= 0.3.13.3")
+  s.add_dependency("sqlite3-ruby", ">= 1.1.0")
+end
+
+Rake::GemPackageTask.new(spec) do |p|
+  p.gem_spec = spec
+  p.need_tar = true
+  p.need_zip = true
+end
+
+
+desc "Publish the zip/tgz"
+task :leetsoft_upload => [:package] do
+  Rake::SshFilePublisher.new("leetsoft.com", "dist/pkg", "pkg", "#{PKG_FILE_NAME}.zip").upload
+  Rake::SshFilePublisher.new("leetsoft.com", "dist/pkg", "pkg", "#{PKG_FILE_NAME}.tgz").upload
+end
+
+desc "Publish the release files to RubyForge."
+task :tag_svn do
+  system("svn cp svn://typosphere.org/typo/trunk svn://typosphere.org/typo/tags/release_#{PKG_VERSION.gsub(/\./,'_')} -m 'tag release #{PKG_VERSION}'")
+end
+
+desc "Publish the release files to RubyForge."
+task :rubyforge_upload => [:package] do
+  files = ["tgz", "zip"].map { |ext| "pkg/#{PKG_FILE_NAME}.#{ext}" }
+
+  if RUBY_FORGE_PROJECT then
+    require 'net/http'
+    require 'open-uri'
+
+    project_uri = "http://rubyforge.org/projects/#{RUBY_FORGE_PROJECT}/"
+    project_data = open(project_uri) { |data| data.read }
+    group_id = project_data[/[?&]group_id=(\d+)/, 1]
+    raise "Couldn't get group id" unless group_id
+
+    # This echos password to shell which is a bit sucky
+    if ENV["RUBY_FORGE_PASSWORD"]
+      password = ENV["RUBY_FORGE_PASSWORD"]
+    else
+      print "#{RUBY_FORGE_USER}@rubyforge.org's password: "
+      password = STDIN.gets.chomp
+    end
+
+    login_response = Net::HTTP.start("rubyforge.org", 80) do |http|
+      data = [
+        "login=1",
+        "form_loginname=#{RUBY_FORGE_USER}",
+        "form_pw=#{password}"
+      ].join("&")
+      http.post("/account/login.php", data)
+    end
+
+    cookie = login_response["set-cookie"]
+    raise "Login failed" unless cookie
+    headers = { "Cookie" => cookie }
+
+    release_uri = "http://rubyforge.org/frs/admin/?group_id=#{group_id}"
+    release_data = open(release_uri, headers) { |data| data.read }
+    package_id = release_data[/[?&]package_id=(\d+)/, 1]
+    raise "Couldn't get package id" unless package_id
+
+    first_file = true
+    release_id = ""
+
+    files.each do |filename|
+      basename  = File.basename(filename)
+      file_ext  = File.extname(filename)
+      file_data = File.open(filename, "rb") { |file| file.read }
+
+      puts "Releasing #{basename}..."
+
+      release_response = Net::HTTP.start("rubyforge.org", 80) do |http|
+        release_date = Time.now.strftime("%Y-%m-%d %H:%M")
+        type_map = {
+          ".zip"    => "3000",
+          ".tgz"    => "3110",
+          ".gz"     => "3110",
+          ".gem"    => "1400"
+        }; type_map.default = "9999"
+        type = type_map[file_ext]
+        boundary = "rubyqMY6QN9bp6e4kS21H4y0zxcvoor"
+
+        query_hash = if first_file then
+          {
+            "group_id" => group_id,
+            "package_id" => package_id,
+            "release_name" => RELEASE_NAME,
+            "release_date" => release_date,
+            "type_id" => type,
+            "processor_id" => "8000", # Any
+            "release_notes" => "",
+            "release_changes" => "",
+            "preformatted" => "1",
+            "submit" => "1"
+          }
+        else
+          {
+            "group_id" => group_id,
+            "release_id" => release_id,
+            "package_id" => package_id,
+            "step2" => "1",
+            "type_id" => type,
+            "processor_id" => "8000", # Any
+            "submit" => "Add This File"
+          }
+        end
+
+        query = "?" + query_hash.map do |(name, value)|
+          [name, URI.encode(value)].join("=")
+        end.join("&")
+
+        data = [
+          "--" + boundary,
+          "Content-Disposition: form-data; name=\"userfile\"; filename=\"#{basename}\"",
+          "Content-Type: application/octet-stream",
+          "Content-Transfer-Encoding: binary",
+          "", file_data, ""
+          ].join("\x0D\x0A")
+
+        release_headers = headers.merge(
+          "Content-Type" => "multipart/form-data; boundary=#{boundary}"
+        )
+
+        target = first_file ? "/frs/admin/qrs.php" : "/frs/admin/editrelease.php"
+        http.post(target + query, data, release_headers)
+      end
+
+      if first_file then
+        release_id = release_response.body[/release_id=(\d+)/, 1]
+        raise("Couldn't get release id") unless release_id
+      end
+
+      first_file = false
+    end
+  end
+end
+
+desc "Upload the package to leetsoft, rubyforge and tag the release in svn"
+task :release => [:sweep_cache, :package, :leetsoft_upload, :rubyforge_upload, :tag_svn ]
+

data/lib/tasks/schemas.rake

@@ -0,0 +1,6 @@
+desc "Create new db/schema files using the migrations.  Requires schema_generator."
+task :schemas do
+  `./script/generate schema --force`
+  `sed s/ENGINE=InnoDB/TYPE=MyISAM/ < db/schema.mysql.sql > db/schema.mysql-v3.sql`
+  `rm db/schema.rb`
+end

data/lib/tasks/sweep_cache.rake

@@ -0,0 +1,6 @@
+desc "Force a sweeping run of typo's static page caches (all of them!)"
+task :sweep_cache => :environment do
+  PageCache.sweep_all
+#  expire_meta_fragment(/.*/)
+  puts "Cache swept."
+end

data/lib/text_filter_plugin.rb

@@ -0,0 +1,97 @@
+class TextFilterPlugin < ContentController
+  uses_component_template_root
+  include ApplicationHelper
+
+  class << self
+    include TypoPlugins
+  end
+
+  plugin_display_name "Unknown Text Filter"
+  plugin_description "Unknown Text Filter Description"
+
+  def self.reloadable?
+    false
+  end
+
+  # Disable HTML errors for subclasses
+  def rescue_action(e)
+    raise e
+  end
+
+  # The name that needs to be used when refering to the plugin's
+  # controller in render statements
+  def self.component_name
+    if (self.to_s =~ /::([a-zA-Z]+)Controller/)
+      "plugins/textfilters/#{$1}".downcase
+    else
+      raise "I don't know who I am: #{self.to_s}"
+    end
+  end
+
+  # The name that's stored in the DB.  This is the final chunk of the
+  # controller name, like 'markdown' or 'smartypants'.
+  def self.short_name
+    component_name.split(%r{/}).last
+  end
+
+  def self.default_config
+    {}
+  end
+
+  def self.help_text
+    ""
+  end
+
+  private
+
+  def self.default_helper_module!
+  end
+  
+  # Look up a config paramater, falling back to the default as needed.
+  def self.config_value(params,name)
+    params[:filterparams][name] || default_config[name][:default]
+  end
+end
+
+class TextFilterPlugin::PostProcess < TextFilterPlugin
+end
+
+class TextFilterPlugin::Macro < TextFilterPlugin
+  # Utility function -- hand it a XML string like <a href="foo" title="bar">
+  # and it'll give you back { "href" => "foo", "title" => "bar" }
+  def self.attributes_parse(string)
+    attributes = Hash.new
+
+    string.gsub(/([^ =]+="[^"]*")/) do |match|
+      key,value = match.split(/=/,2)
+      attributes[key] = value.gsub(/"/,'')
+    end
+
+    attributes
+  end
+
+  def self.filtertext(controller, content, text, params)
+    filterparams = params[:filterparams]
+    regex1 = /<typo:#{short_name}[^>]*\/>/
+    regex2 = /<typo:#{short_name}([^>]*)>(.*?)<\/typo:#{short_name}>/m
+
+    new_text = text.gsub(regex1) do |match|
+      macrofilter(controller,content,attributes_parse(match),params)
+    end
+
+    new_text = new_text.gsub(regex2) do |match|
+      macrofilter(controller,content,attributes_parse($1.to_s),params,$2.to_s)
+    end
+
+    new_text
+  end
+end
+
+class TextFilterPlugin::MacroPre < TextFilterPlugin::Macro
+end
+
+class TextFilterPlugin::MacroPost < TextFilterPlugin::Macro
+end
+
+class TextFilterPlugin::Markup < TextFilterPlugin
+end

data/lib/transforms.rb

@@ -0,0 +1,26 @@
+class String
+  # Returns a-string-with-dashes when passed 'a string with dashes'.
+  # All special chars are stripped in the process
+  def to_url
+    return if self.nil?
+
+    self.downcase.tr("\"'", '').gsub(/\W/, ' ').strip.tr_s(' ', '-').tr(' ', '-').sub(/^$/, "-")
+  end
+
+  # A quick and dirty fix to add 'nofollow' to any urls in a string.
+  # Decidedly unsafe, but will have to do for now.
+  def nofollowify
+    self.gsub(/<\s*a\s*(.+?)>/i, '<a \1 rel="nofollow">')
+  end
+
+  # Strips any html markup from a string
+  TYPO_TAG_KEY = TYPO_ATTRIBUTE_KEY = /[\w:_-]+/
+  TYPO_ATTRIBUTE_VALUE = /(?:[A-Za-z0-9]+|(?:'[^']*?'|"[^"]*?"))/
+  TYPO_ATTRIBUTE = /(?:#{TYPO_ATTRIBUTE_KEY}(?:\s*=\s*#{TYPO_ATTRIBUTE_VALUE})?)/
+  TYPO_ATTRIBUTES = /(?:#{TYPO_ATTRIBUTE}(?:\s+#{TYPO_ATTRIBUTE})*)/
+  TAG = %r{<[!/?\[]?(?:#{TYPO_TAG_KEY}|--)(?:\s+#{TYPO_ATTRIBUTES})?\s*(?:[!/?\]]+|--)?>}
+  def strip_html
+    self.gsub(TAG, '').gsub(/\s+/, ' ').strip
+  end
+
+end

data/lib/typo_guid.rb

@@ -0,0 +1,10 @@
+require 'md5'
+
+module TypoGuid
+  def create_guid
+    self.guid rescue return true
+    return true unless self.guid.blank?
+
+    self.guid = UUID.random_create.to_s
+  end
+end