Following up the mailing list discussion I modified my original patch
to achieve the following behavior:
(1) By default HTML comments <!--...--> are *NOT* recognized in wiki
markup, exactly the same way as it is now.
(2) An Admin can switch HTML comments ON in wiki markup by means of a
new check-box in the web interface Admin->Configuration section. The
text by the check-box strongly suggests denying an anonymous user
ability of editing wiki pages if HTML comments are enabled.
I hope that with these modifications security and privacy issues
related to HTML comments have been addressed.
--Leo--
#### Fossil-SCM patch against trunk commit:
artifact: 937514b96854b8ba378850ebab10cd893fed5d75
size: 22483 bytes
tags: trunk
type: Check-in by drh on 2012-02-11 18:25:16
comment: Further diff enhancements: Allow up to two diff-marks per line on a
side-by-side diff.
####
Index: src/setup.c
==================================================================
--- src/setup.c~0 2012-02-12 22:16:47.000000000 -0500
+++ src/setup.c 2012-02-12 21:03:44.000000000 -0500
@@ -1175,10 +1175,17 @@ void setup_config(void){
@ <p>Note: To avoid a redirect loop or other problems, this entry must
@ begin with "/" and it must specify a valid page. For example,
@ "<b>/home</b>" will work but "<b>home</b>" will not, since it omits the
@ leading "/".</p>
@ <hr />
+ onoff_attribute("Honor HTML comments in wiki markup",
+ "wiki-html-comments", "wiki-html-comments", 0);
+ @ <p>Allow HTML type comments <!--...--> in wiki markup (both wiki pages)
+ @ and embedded documentation. </p>
+ @ <p><strong>CAUTION:</strong> You are advised to deny anonymous user ability to
+ @ edit wiki pages to prevent hidden text in wiki sources. </p>
+ @ <hr />
onoff_attribute("Use HTML as wiki markup language",
"wiki-use-html", "wiki-use-html", 0);
@ <p>Use HTML as the wiki markup language. Wiki links will still be parsed
@ but all other wiki formatting will be ignored. This option is helpful
@ if you have chosen to use a rich HTML editor for wiki markup such as
Index: src/wikiformat.c
==================================================================
--- src/wikiformat.c~0 2012-02-12 22:16:47.000000000 -0500
+++ src/wikiformat.c 2012-02-12 21:06:50.000000000 -0500
@@ -404,10 +404,42 @@ static int wikiUsesHtml(void){
static int r = -1;
if( r<0 ) r = db_get_boolean("wiki-use-html", 0);
return r;
}
+/** Returns true if HTML comments <!--.....--> are honored by the wiki markup
+ */
+static int wiki_allows_HTML_comments(void){
+ static int r= -1;
+ if( r<0 ){ r = db_get_boolean("wiki-html-comments", 0); }
+ return r;
+}
+
+/** Deals with HTML comments <!--...-->
+ * z points to '<' char. Returns number of chars in the HTML comment
+ * or -1 if markup is not a comment.
+ */
+static int markupLength_comment(const char *z){
+ if( strncmp(z, "<!--", 4) == 0 ){
+ int n= 4; /* points one after "<!--" */
+ char c;
+ while( 1 ){
+ for( c=z[n]; c && c!='-'; c=z[++n] ); /* find next '-' */
+ if( c=='-' ){
+ if( strncmp(&z[n], "-->", 3) ){
+ return n + 3;
+ }else{
+ n++;
+ }
+ }else{
+ return -1;
+ }
+ }
+ }
+ return -1;
+}
+
/*
** z points to a "<" character. Check to see if this is the start of
** a valid markup. If it is, return the total number of characters in
** the markup including the initial "<" and the terminating ">". If
** it is not well-formed markup, return 0.
@@ -596,10 +628,15 @@ static int linkLength(const char *z){
** characters in that token. Write the token type into *pTokenType.
*/
static int nextWikiToken(const char *z, Renderer *p, int *pTokenType){
int n;
if( z[0]=='<' ){
+ if( wiki_allows_HTML_comments() &&
+ (n=markupLength_comment(z)) > 0 ){
+ *pTokenType= TOKEN_RAW;
+ return n;
+ }
n = markupLength(z);
if( n>0 ){
*pTokenType = TOKEN_MARKUP;
return n;
}else{
#EoF
_______________________________________________
fossil-users mailing list
[email protected]
http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
