fixed to run at security level 1

Author: wilkes

jWebUnit/fitplugin/rubywiki/changes.rb

@@ -11,7 +11,7 @@
 
 LINK = "[A-Z][a-z0-9]+([A-Z][a-z0-9]+)+"
 
-datedpages = Dir.entries('pages').select {|e| e =~ /#{LINK}/}
+datedpages = Dir.entries('pages').select {|e| e.untaint =~ /#{LINK}/}
 datedpages.map! {|e| [File.mtime("pages/#{e}"), e]}
 datedpages.sort! { |a,b| b[0] <=> a[0] }
 

jWebUnit/fitplugin/rubywiki/edit.rb

@@ -13,6 +13,7 @@
 LINK = "[A-Z][a-z0-9]+([A-Z][a-z0-9]+)+";
 MARK = "\263";
 page = ENV['QUERY_STRING'] =~ /^(#{LINK})$/ ? $1 : "WelcomeVisitors"  # $& is the last match
+page.untaint
 mode = $_ =~ /append/ ##??????
 puts "<!-- #{mode.inspect} -->"
 

jWebUnit/fitplugin/rubywiki/refcount.rb

@@ -13,7 +13,7 @@
 
 LINK = "([A-Z][a-z0-9]+([A-Z][a-z0-9]+)+)";
 
-files = Dir.entries('pages').select {|e| e =~ /#{LINK}/}.sort!
+files = Dir.entries('pages').select {|e| e.untaint =~ /#{LINK}/}.sort!
 
 refs = {}
 all_targets = []

jWebUnit/fitplugin/rubywiki/save.rb

@@ -12,7 +12,7 @@
 LINK = "[A-Z][a-z0-9]+([A-Z][a-z0-9]+)+";
 
 page = ENV['QUERY_STRING'] =~ /^(#{LINK})$/ ? $1 : "WelcomeVisitors"  # $& is the last match
-
+page.untaint
 params = CGI.new.params
 bodyHash = {}
 params.each { |k,v|
@@ -44,7 +44,8 @@
 
 File.open("pages/#{page}", mode) { |f| f.print s }
 
-require 'wiki.rb' # maybe work?
+
+require './wiki.rb' # maybe work?
 
 #my %par;
 #$par{title} = "Thank You";

jWebUnit/fitplugin/rubywiki/search.rb

@@ -14,7 +14,7 @@
 LINK = "[A-Z][a-z0-9]+([A-Z][a-z0-9]+)+"
 
 ENV['QUERY_STRING'] =~ /search=([^\&]*)/
-target = $1
+target = $1.untaint
 target.gsub!(/\+/, ' ')
 target.gsub!(/\%(..)/) {[$1.hex].pack('C') }
 
@@ -30,7 +30,7 @@
  </form>
 EOF
 
-files = Dir.entries('pages').select {|e| e =~ /#{LINK}/}.sort!
+files = Dir.entries('pages').select {|e| e.untaint =~ /#{LINK}/}.sort!
 
 hits = 0
 files.each do |file|

jWebUnit/fitplugin/rubywiki/wiki.rb

@@ -145,7 +145,7 @@ def inPlaceUrl(origRef)
 print "Content-type: text/html\n\n"
 
 page = ENV['QUERY_STRING'] =~ /^(#{LINK})$/ ? $1 : "WelcomeVisitors"  # $& is the last match
-
+page.untaint
 par = {}
 par['page' ] = page
 par['title'] = page.gsub(/(.)([A-Z])/, '\1 \2')
@@ -166,7 +166,7 @@ def inPlaceUrl(origRef)
 end
 
 par['summary'] = " -- Last edited #{date}" if date
-par['body'] = formatBody(body)
+par['body'] = formatBody(body.untaint)
 par['action'] = <<-BLAH
 <form method=post action="edit.rb?#{page}">
 <input type=submit value=" Edit ">