Release 3.1.2

Set the allow_editing wiki option to true by default.

HISTORY.md

@@ -1,3 +1,7 @@
+# 3.1.1 /2014-12-04
+
+* Security fix for [remote code execution issue](https://github.com/gollum/gollum/issues/913). Please update!
+
 # 3.1 / 2014-11-28
 
 * New features

README.md

@@ -109,6 +109,7 @@ Options:
         --base-path [PATH]           Specify the base path for the served pages (default: /) Example: --base-path wiki yields the home page accessible at http://localhost:4567/wiki/.
         --gollum-path [PATH]         Specify the path to the git repository to be served.
         --ref [REF]                  Specify the repository ref to use (default: master).
+        --bare                       Specify that the repository is bare (only necessary when using the grit adapter).
         --no-edit                    Restricts editing capability through frontend.
         --no-live-preview            Disables livepreview.
         --live-preview               Enables livepreview.

bin/gollum

@@ -81,6 +81,10 @@ opts = OptionParser.new do |opts|
     wiki_options[:ref] = ref
   end
 
+  opts.on("--bare", "Specify that the repository is bare (only necessary when using the grit adapter).") do
+    wiki_options[:repo_is_bare] = true
+  end
+
   opts.on("--no-edit", "Restricts editing capability through frontend.")  do
     wiki_options[:allow_editing] = false
   end

gollum.gemspec

@@ -5,8 +5,8 @@ Gem::Specification.new do |s|
   s.required_ruby_version = '>= 1.9'
 
   s.name              = 'gollum'
-  s.version           = '3.1.1'
+  s.version           = '3.1.2'
-  s.date              = '2014-12-04'
+  s.date              = '2015-01-23'
   s.rubyforge_project = 'gollum'
   s.license           = 'MIT'
 

lib/gollum.rb

@@ -16,7 +16,7 @@ require File.expand_path('../gollum/uri_encode_component', __FILE__)
 $KCODE = 'U' if RUBY_VERSION[0, 3] == '1.8'
 
 module Gollum
-  VERSION = '3.1.1'
+  VERSION = '3.1.2'
 
   def self.assets_path
     ::File.expand_path('gollum/public', ::File.dirname(__FILE__))

lib/gollum/app.rb

@@ -22,6 +22,13 @@ Gollum::set_git_max_filesize(190 * 10**6)
 # Fix to_url
 class String
   alias :upstream_to_url :to_url
+
+  if defined?(Gollum::GIT_ADAPTER) && Gollum::GIT_ADAPTER != 'grit'
+    def to_ascii
+      self # Do not transliterate utf-8 url's unless using Grit
+    end
+  end
+  
   # _Header => header which causes errors
   def to_url
     return nil if self.nil?
@@ -95,7 +102,8 @@ module Precious
       @css = settings.wiki_options[:css]
       @js  = settings.wiki_options[:js]
       @mathjax_config = settings.wiki_options[:mathjax_config]
-      @allow_editing = settings.wiki_options.fetch(:allow_editing, true)
+      settings.wiki_options[:allow_editing] = settings.wiki_options.fetch(:allow_editing, true)
+      @allow_editing = settings.wiki_options[:allow_editing]
     end
 
     get '/' do
@@ -310,7 +318,7 @@ module Precious
         wiki.write_page(name, format, params[:content], commit_message, path)
 
         page_dir = settings.wiki_options[:page_file_dir].to_s
-        redirect to("/#{clean_url(::File.join(page_dir, path, name))}")
+        redirect to("/#{clean_url(::File.join(page_dir, path, encodeURIComponent(name)))}")
       rescue Gollum::DuplicatePageError => e
         @message = "Duplicate page: #{e.message}"
         mustache :error
@@ -372,7 +380,7 @@ module Precious
     end
     
     post '/compare/*' do
-      @file     = params[:splat].first
+      @file     = encodeURIComponent(params[:splat].first)
       @versions = params[:versions] || []
       if @versions.size < 2
         redirect to("/history/#{@file}")
@@ -443,6 +451,7 @@ module Precious
       wiki         = Gollum::Wiki.new(settings.gollum_path, wiki_options)
       @results     = wiki.pages
       @results     += wiki.files if settings.wiki_options[:show_all]
+      @results     = @results.sort_by { |p| p.name.downcase } # Sort Results alphabetically, fixes 922
       @ref         = wiki.ref
       mustache :pages
     end

lib/gollum/editing_auth.rb

@@ -7,7 +7,7 @@ module Precious
     def call(env)
       @env = env
       # Blocks all potentially editable pages. Use EditingAuth::whitelist_pages to unblock pages.
-      unless (env["REQUEST_METHOD"] == "GET") || App::settings.wiki_options[:allow_editing]
+      unless (env["REQUEST_METHOD"] == "GET") || @app.settings.wiki_options[:allow_editing]
         return block unless excluded_page?
       end
       @app.call(env)

lib/gollum/helpers.rb

@@ -39,7 +39,7 @@ module Precious
       url.gsub('%2F', '/').gsub(/^\/+/, '').gsub('//', '/')
     end
 
-    def forbid(msg = "Forbidden.")
+    def forbid(msg = "Forbidden. This wiki is set to no-edit mode.")
       @message = msg
       status 403
       halt mustache :error

test/examples/lotr.git/logs/HEAD

@@ -8,3 +8,4 @@ cfea406f5f77afc7fb673a43e97721234385b1bd 629aa678272b017a4d136d35e77ac94d80b08dc
 629aa678272b017a4d136d35e77ac94d80b08dc2 7d6aeab8b84c895f21f6c66b84a457b0fced9693 Daniel Kimsey <dekimsey@ufl.edu> 1352501984 -0500	push
 7d6aeab8b84c895f21f6c66b84a457b0fced9693 563cc3701db990caf63e4ce9c3697a062890ca48 James Dabbs <jamesdabbs@gmail.com> 1361843315 -0500	push
 563cc3701db990caf63e4ce9c3697a062890ca48 874f597a5659b4c3b153674ea04e406ff393975e Charles Pence <charles@charlespence.net> 1363478075 -0400	push
+874f597a5659b4c3b153674ea04e406ff393975e 7bdfe65face6f7cf9877d8c1d8c1dd974a63745e Nathan Lowe <techwiz96@gmail.com> 1421012322 -0500	push

test/examples/lotr.git/logs/refs/heads/master

@@ -8,3 +8,4 @@ cfea406f5f77afc7fb673a43e97721234385b1bd 629aa678272b017a4d136d35e77ac94d80b08dc
 629aa678272b017a4d136d35e77ac94d80b08dc2 7d6aeab8b84c895f21f6c66b84a457b0fced9693 Daniel Kimsey <dekimsey@ufl.edu> 1352501984 -0500	push
 7d6aeab8b84c895f21f6c66b84a457b0fced9693 563cc3701db990caf63e4ce9c3697a062890ca48 James Dabbs <jamesdabbs@gmail.com> 1361843315 -0500	push
 563cc3701db990caf63e4ce9c3697a062890ca48 874f597a5659b4c3b153674ea04e406ff393975e Charles Pence <charles@charlespence.net> 1363478075 -0400	push
+874f597a5659b4c3b153674ea04e406ff393975e 7bdfe65face6f7cf9877d8c1d8c1dd974a63745e Nathan Lowe <techwiz96@gmail.com> 1421012322 -0500	push

test/examples/lotr.git/objects/f5/9001ceaca4caaaa24fb1b8da3deaaf7f42893a

@@ -0,0 +1,3 @@
+x

йA
+─ пж²Б╥
+\HкN ╢/═f(┴мxЪzК*╛к═■И
фG≥■┌%о┌ё▀PCaHNЮ╘²┬ы?▓^п┘][mА╗ч%╣≥АЧ╣QEТЬ
зvh

test/examples/lotr.git/refs/heads/master

@@ -1 +1 @@
-874f597a5659b4c3b153674ea04e406ff393975e
+7bdfe65face6f7cf9877d8c1d8c1dd974a63745e

test/helper.rb

@@ -17,6 +17,10 @@ dir = File.dirname(File.expand_path(__FILE__))
 $LOAD_PATH.unshift(File.join(dir, '..', 'lib'))
 $LOAD_PATH.unshift(dir)
 
+module Gollum
+end
+Gollum::GIT_ADAPTER = ENV['GIT_ADAPTER'] if ENV['GIT_ADAPTER']
+
 ENV['RACK_ENV'] = 'test'
 require 'gollum'
 require 'gollum/app'

test/test_app.rb

@@ -78,7 +78,7 @@ context "Frontend" do
 
     get page
 
-    expected = "<h2><a class=\"anchor\" id=\"_#{text}\" href=\"#_#{text}\"><i class=\"fa fa-link\"></i></a>#{text}</h2>"
+    expected = "<h2><a class=\"anchor\" id=\"#{text}\" href=\"##{text}\"><i class=\"fa fa-link\"></i></a>#{text}</h2>"
     actual   = nfd(last_response.body)
 
     assert_match /#{expected}/, actual
@@ -619,6 +619,7 @@ context "Frontend with lotr" do
     assert !body.include?("Boromir"), "/pages should NOT include the page 'Boromir'"
     assert body.include?("Mordor"), "/pages should include the folder 'Mordor'"
     assert !body.include?("Eye Of Sauron"), "/pages should NOT include the page 'Eye Of Sauron'"
+    assert !body.match(/(Zamin).+(roast\-mutton)/m), "/pages should be sorted alphabetically"
   end
 
   test "/pages/Mordor/" do

test/test_latest_changes_view.rb

@@ -19,9 +19,10 @@ context "Precious::Views::LatestChanges" do
   test "displays_latest_changes" do
     get('/latest_changes')
     body = last_response.body
+
     assert body.include?('<span class="username">Charles Pence</span>'), "/latest_changes should include the Author Charles Pence"
-    assert body.include?('60f12f4'), "/latest_changes should include the :latest_changes_count commit"
+    assert body.include?('a8ad3c0'), "/latest_changes should include the :latest_changes_count commit"
-    assert !body.include?('0ed8cbe'), "/latest_changes should not include more than latest_changes_count commits"
+    assert !body.include?('60f12f4'), "/latest_changes should not include more than latest_changes_count commits"
     assert body.include?('<a href="Data-Two.csv/874f597a5659b4c3b153674ea04e406ff393975e">Data-Two.csv</a>'), "/latest_changes include links to modified files in #{body}"
     assert body.include?('<a href="Hobbit/874f597a5659b4c3b153674ea04e406ff393975e">Hobbit.md</a>'), "/latest_changes should include links to modified pages in #{body}"
   end