BugTrack/2525 Invalid page name mechanism

diff --git a/lib/func.php b/lib/func.php
index de6df81..e716122 100644 (file)
--- a/lib/func.php
+++ b/lib/func.php
@@ -644,6 +644,21 @@ EOD;
        exit;
 }
 
+function die_invalid_pagename() {
+       $title = 'Error';
+       $page = 'Error: Invlid page name';
+       $body = <<<EOD
+<h3>Error</h3>
+<strong>Error message: Invalid page name</strong>
+EOD;
+
+       pkwk_common_headers();
+       header('HTTP/1.0 400 Bad request');
+       catbody($title, $page, $body);
+       exit;
+}
+
+
 // Have the time (as microtime)
 function getmicrotime()
 {
@@ -858,8 +873,8 @@ function get_base_uri($uri_type = PKWK_URI_RELATIVE)
  */
 function get_page_uri($page, $uri_type = PKWK_URI_RELATIVE)
 {
-       global $pkwk_page_uri_handler;
-       return get_base_uri($uri_type) . $pkwk_page_uri_handler->get_page_uri_fragment($page);
+       global $page_uri_handler;
+       return get_base_uri($uri_type) . $page_uri_handler->get_page_uri_fragment($page);
 }
 
 // Get absolute-URI of this script
@@ -1174,6 +1189,7 @@ function get_preg_u() {
        return $utf8u;
 }
 
+// Default Page name - URI mapping handler
 class PukiWikiStandardPageURIHandler {
        function filter_raw_query_string($query_string) {
                return $query_string;
@@ -1184,19 +1200,20 @@ class PukiWikiStandardPageURIHandler {
        }
 
        function get_page_from_query_string($query_string) {
-               $arg = $query_string;
-               $arg = preg_replace("#^([^&]*)&.*$#", "$1", $arg);
-               if ($arg == '') {
-                       return null;
+               $param1st = preg_replace("#^([^&]*)&.*$#", "$1", $query_string);
+               if ($param1st == '') {
+                       return null; // default page
                }
-               if (strpos($arg, '=') !== false) {
-                       // Found '/?key=value'
-                       return null;
+               if (strpos($param1st, '=') !== FALSE) {
+                       // Found '/?key=value' (NG chars)
+                       return FALSE; // Error page
+               }
+               $page = urldecode($param1st);
+               $page2 = input_filter($page);
+               if ($page !== $page2) {
+                       return FALSE; // Error page
                }
-               $arg = urldecode($arg);
-               $arg = strip_bracket($arg);
-               $arg = input_filter($arg);
-               return $arg;
+               return $page2;
        }
 }
 

diff --git a/lib/init.php b/lib/init.php
index 2dedd73..4c323ec 100644 (file)
--- a/lib/init.php
+++ b/lib/init.php
@@ -63,6 +63,12 @@ if (! file_exists(INI_FILE) || ! is_readable(INI_FILE)) {
 if ($die) die_message(nl2br("\n\n" . $die));
 
 /////////////////////////////////////////////////
+// Page-URI mapping handler (default)
+if (! $page_uri_handler) {
+       $page_uri_handler = new PukiWikiStandardPageURIHandler();
+}
+
+/////////////////////////////////////////////////
 // INI_FILE: LANG に基づくエンコーディング設定
 
 // MB_LANGUAGE: mb_language (for mbstring extension)
@@ -296,7 +302,7 @@ if (PKWK_QUERY_STRING_MAX && strlen($arg) > PKWK_QUERY_STRING_MAX) {
 $arg = input_filter($arg); // \0 除去
 
 // Convert QueryString by PageURIHandler
-$arg_replaced = $pkwk_page_uri_handler->filter_raw_query_string($arg);
+$arg_replaced = $page_uri_handler->filter_raw_query_string($arg);
 if ($arg_replaced !== $arg) {
        $_GET = array();
        $m = array();
@@ -413,8 +419,12 @@ if (isset($get['md5']) && $get['md5'] != '' &&
 if (! isset($vars['cmd']) && ! isset($vars['plugin'])) {
 
        $get['cmd']  = $post['cmd']  = $vars['cmd']  = 'read';
-       $arg = $pkwk_page_uri_handler->get_page_from_query_string($arg);
-       if (!$arg) {
+       $arg = $page_uri_handler->get_page_from_query_string($arg);
+       if ($arg === FALSE) {
+               // page is FALSE if page name is not valid
+               // Keep $arg is FALSE
+       } else if (!$arg) {
+               // if $arg is null or '' ($arg is NOT FALSE)
                $arg = $defaultpage;
        }
        $get['page'] = $post['page'] = $vars['page'] = $arg;

diff --git a/lib/pukiwiki.php b/lib/pukiwiki.php
index 79e12a5..a784e3c 100644 (file)
--- a/lib/pukiwiki.php
+++ b/lib/pukiwiki.php
@@ -45,6 +45,10 @@ if ($notify) {
 
 /////////////////////////////////////////////////
 // Main
+if ($vars['page'] === FALSE) {
+       die_invalid_pagename();
+       exit;
+}
 if (manage_page_redirect()) {
        exit;
 }

diff --git a/pukiwiki.ini.php b/pukiwiki.ini.php
index 7942eb2..61f6924 100644 (file)
--- a/pukiwiki.ini.php
+++ b/pukiwiki.ini.php
@@ -543,8 +543,9 @@ $logging_updates = 0;
 $logging_updates_log_dir = '/var/log/pukiwiki';
 
 /////////////////////////////////////////////////
-// Page-URI mapping handler
-$pkwk_page_uri_handler = new PukiWikiStandardPageURIHandler();
+// Page-URI mapping handler ( ref: https://pukiwiki.osdn.jp/?PukiWiki/PageURI )
+$page_uri_handler = null; // default
+// $page_uri_handler = new PukiWikiStandardPageURIHandler();
 
 /////////////////////////////////////////////////
 // User-Agent settings