Honour umask when creating the comments directory

[software/blitiri.git] / blitiri.cgi

diff --git a/blitiri.cgi b/blitiri.cgi
index df2920544f83b64c018ad6e39699780b91c43189..0ffc81a6ac40851dbc1944aa90794c33f413f1bb 100755 (executable)
--- a/blitiri.cgi
+++ b/blitiri.cgi
@@ -46,32 +46,13 @@ author = "Hartmut Kegan"
 # Article encoding
 encoding = "utf8"
 
 # Article encoding
 encoding = "utf8"
 

-# Captcha class
-class Captcha (object):
-       def __init__(self, article):
-               self.article = article
-               words = article.title.split()
-               self.nword = hash(article.title) % len(words) % 5
-               self.answer = words[self.nword]
-               self.help = 'gotcha, damn spam bot!'
+# Captcha method to use. At the moment only "title" is supported, but if you
+# are keen with Python you can provide your own captcha implementation, see
+# below for details.
+captcha_method = "title"

 
 

-       def get_puzzle(self):
-               nword = self.nword + 1
-               if nword == 1:
-                       n = '1st'
-               elif nword == 2:
-                       n = '2nd'
-               elif nword == 3:
-                       n = '3rd'
-               else:
-                       n = str(nword) + 'th'
-               return "enter the %s word of the article's title" % n
-       puzzle = property(fget = get_puzzle)
-
-       def validate(self, form_data):
-               if form_data.captcha.lower() == self.answer.lower():
-                       return True
-               return False
+# How many articles to show in the index
+index_articles = 10

 
 
 #
 
 
 #


@@ -107,6 +88,84 @@ except:
 data_path = os.path.realpath(data_path)
 templates_path = os.path.realpath(templates_path)
 
 data_path = os.path.realpath(data_path)
 templates_path = os.path.realpath(templates_path)
 

+
+#
+# Captcha classes
+#
+# They must follow the interface described below.
+#
+# Constructor:
+#      Captcha(article) -> constructor, takes an article[1] as argument
+# Attributes:
+#      puzzle -> a string with the puzzle the user must solve to prove he is
+#                not a bot (can be raw HTML)
+#      help -> a string with extra instructions, shown only when the user
+#              failed to solve the puzzle
+# Methods:
+#      validate(form_data) -> based on the form data[2],  returns True if
+#                             the user has solved the puzzle uccessfully
+#                             (False otherwise).
+#
+# Note you must ensure that the puzzle attribute and validate() method can
+# "communicate" because they are executed in different requests. You can pass a
+# cookie or just calculate the answer based on the article's data, for example.
+#
+# [1] article is an object with all the article's information:
+#      path -> string
+#      created -> datetime
+#      updated -> datetime
+#      uuid -> string (unique ID)
+#      title -> string
+#      author -> string
+#      tags -> list of strings
+#      raw_contents -> string in rst format
+#      comments -> list of Comment objects (not too relevant here)
+# [2] form_data is an object with the form fields (all strings):
+#      author, author_error
+#      link, link_error
+#      catpcha, captcha_error
+#      body, body_error
+#      action, method
+
+class TitleCaptcha (object):
+       "Captcha that uses the article's title for the puzzle"
+       def __init__(self, article):
+               self.article = article
+               words = article.title.split()
+               self.nword = hash(article.title) % len(words) % 5
+               self.answer = words[self.nword]
+               self.help = 'gotcha, damn spam bot!'
+
+       @property
+       def puzzle(self):
+               nword = self.nword + 1
+               if nword == 1:
+                       n = '1st'
+               elif nword == 2:
+                       n = '2nd'
+               elif nword == 3:
+                       n = '3rd'
+               else:
+                       n = str(nword) + 'th'
+               return "enter the %s word of the article's title" % n
+
+       def validate(self, form_data):
+               if form_data.captcha.lower() == self.answer.lower():
+                       return True
+               return False
+
+known_captcha_methods = {
+       'title': TitleCaptcha,
+}
+
+# If the configured captcha method was a known string, replace it by the
+# matching class; otherwise assume it's already a class and leave it
+# alone. This way the user can either use one of our methods, or provide one
+# of his/her own.
+if captcha_method in known_captcha_methods:
+       captcha_method = known_captcha_methods[captcha_method]
+
+

 # Default template
 
 default_main_header = """\
 # Default template
 
 default_main_header = """\


@@ -136,6 +195,7 @@ default_main_footer = """
   years: %(yearlinks)s<br/>
   subscribe: <a href="%(url)s/atom">atom</a><br/>
   views: <a href="%(url)s/">blog</a> <a href="%(url)s/list">list</a><br/>
   years: %(yearlinks)s<br/>
   subscribe: <a href="%(url)s/atom">atom</a><br/>
   views: <a href="%(url)s/">blog</a> <a href="%(url)s/list">list</a><br/>

+  tags: %(taglinks)s<br/>

 </div>
 
 </body>
 </div>
 
 </body>


@@ -410,23 +470,32 @@ div.section h1 {
 
 """
 
 
 """
 

+

 # Cache decorator
 # Cache decorator

+# It only works if the function is pure (that is, its return value depends
+# only on its arguments), and if all the arguments are hash()eable.

 def cached(f):
 def cached(f):

-       def decorate(obj, *args, **kwargs):
-               if cache_path is None: # cache disabled
-                       s = f(obj, *args, **kwargs)
-               else:
-                       cache_file = os.path.join(cache_path,
-                                       'blitiri.cache.%s.html' % hash(obj))
-                       try:
-                               s = open(cache_file).read()
-                       except:
-                               s = f(obj, *args, **kwargs)
-                               open(cache_file, 'w').write(s)
+       # do not decorate if the cache is disabled
+       if cache_path is None:
+               return f
+
+       def decorate(*args, **kwargs):
+               hashes = '-'.join( str(hash(x)) for x in args +
+                               tuple(kwargs.items()) )
+               fname = 'blitiri.%s.%s.cache' % (f.__name__, hashes)
+               cache_file = os.path.join(cache_path, fname)
+               try:
+                       s = open(cache_file).read()
+               except:
+                       s = f(*args, **kwargs)
+                       open(cache_file, 'w').write(s)

                return s
                return s

+

        return decorate
 
        return decorate
 

+

 # helper functions
 # helper functions

+@cached

 def rst_to_html(rst, secure = True):
        settings = {
                'input_encoding': encoding,
 def rst_to_html(rst, secure = True):
        settings = {
                'input_encoding': encoding,


@@ -439,7 +508,6 @@ def rst_to_html(rst, secure = True):
        parts = publish_parts(rst, settings_overrides = settings,
                                writer_name = "html")
        return parts['body'].encode('utf8')
        parts = publish_parts(rst, settings_overrides = settings,
                                writer_name = "html")
        return parts['body'].encode('utf8')

-rst_to_html = cached(rst_to_html)

 
 def validate_rst(rst, secure = True):
        try:
 
 def validate_rst(rst, secure = True):
        try:


@@ -460,26 +528,32 @@ def validate_rst(rst, secure = True):
 
 def valid_link(link):
        import re
 
 def valid_link(link):
        import re

-       mail_re = r"^[^ \t\n\r@<>()]+@[a-z0-9][a-z0-9\.\-_]*\.[a-z]+$"

        scheme_re = r'^[a-zA-Z]+:'
        scheme_re = r'^[a-zA-Z]+:'

+       mail_re = r"^[^ \t\n\r@<>()]+@[a-z0-9][a-z0-9\.\-_]*\.[a-z]+$"

        url_re = r'^(?:[a-z0-9\-]+|[a-z0-9][a-z0-9\-\.\_]*\.[a-z]+)' \
                        r'(?::[0-9]+)?(?:/.*)?$'
        url_re = r'^(?:[a-z0-9\-]+|[a-z0-9][a-z0-9\-\.\_]*\.[a-z]+)' \
                        r'(?::[0-9]+)?(?:/.*)?$'

-       scheme = ''
-       rest = link
+

        if re.match(scheme_re, link, re.I):
                scheme, rest = link.split(':', 1)
        if re.match(scheme_re, link, re.I):
                scheme, rest = link.split(':', 1)

-       if (not scheme or scheme == 'mailto') and re.match(mail_re, rest, re.I):
+               # if we have an scheme and a rest, assume the link is valid
+               # and return it as-is; otherwise (having just the scheme) is
+               # invalid
+               if rest:
+                       return link
+               return None
+
+       # at this point, we don't have a scheme; we will try to recognize some
+       # common addresses (mail and http at the moment) and complete them to
+       # form a valid link, if we fail we will just claim it's invalid
+       if re.match(mail_re, link, re.I):

                return 'mailto:' + link
                return 'mailto:' + link

-       if not scheme and re.match(url_re, rest, re.I):
-               return 'http://' + rest
-       if scheme:
-               return link
+       elif re.match(url_re, link, re.I):
+               return 'http://' + link
+

        return None
 
 def sanitize(obj):
        return None
 
 def sanitize(obj):

-       if isinstance(obj, basestring):
-               return cgi.escape(obj, True)
-       return obj
+       return cgi.escape(obj, quote = True)

 
 
 # find out our URL, needed for syndication
 
 
 # find out our URL, needed for syndication


@@ -513,6 +587,7 @@ class Templates (object):
                        'showyear': showyear,
                        'monthlinks': ' '.join(db.get_month_links(showyear)),
                        'yearlinks': ' '.join(db.get_year_links()),
                        'showyear': showyear,
                        'monthlinks': ' '.join(db.get_month_links(showyear)),
                        'yearlinks': ' '.join(db.get_year_links()),

+                       'taglinks': ' '.join(db.get_tag_links()),

                }
 
        def get_template(self, page_name, default_template, extra_vars = None):
                }
 
        def get_template(self, page_name, default_template, extra_vars = None):


@@ -545,9 +620,9 @@ class Templates (object):
                vars = comment.to_vars()
                if comment.link:
                        vars['linked_author'] = '<a href="%s">%s</a>' \
                vars = comment.to_vars()
                if comment.link:
                        vars['linked_author'] = '<a href="%s">%s</a>' \

-                                       % (comment.link, comment.author)
+                                       % (vars['link'], vars['author'])

                else:
                else:

-                       vars['linked_author'] = comment.author
+                       vars['linked_author'] = vars['author']

                return self.get_template(
                        'com_header', default_comment_header, vars)
 
                return self.get_template(
                        'com_header', default_comment_header, vars)
 


@@ -619,25 +694,23 @@ class Comment (object):
                self._link = ''
                self._raw_content = 'Removed comment'
 
                self._link = ''
                self._raw_content = 'Removed comment'
 

-
-       def get_author(self):
+       @property
+       def author(self):

                if not self.loaded:
                        self.load()
                return self._author
                if not self.loaded:
                        self.load()
                return self._author

-       author = property(fget = get_author)

 
 

-       def get_link(self):
+       @property
+       def link(self):

                if not self.loaded:
                        self.load()
                return self._link
                if not self.loaded:
                        self.load()
                return self._link

-       link = property(fget = get_link)

 
 

-       def get_raw_content(self):
+       @property
+       def raw_content(self):

                if not self.loaded:
                        self.load()
                return self._raw_content
                if not self.loaded:
                        self.load()
                return self._raw_content

-       raw_content = property(fget = get_raw_content)
-

 
        def set(self, author, raw_content, link = '', created = None):
                self.loaded = True
 
        def set(self, author, raw_content, link = '', created = None):
                self.loaded = True


@@ -705,6 +778,11 @@ class Comment (object):
 class CommentDB (object):
        def __init__(self, article):
                self.path = os.path.join(comments_path, article.uuid)
 class CommentDB (object):
        def __init__(self, article):
                self.path = os.path.join(comments_path, article.uuid)

+               # if comments were enabled after the article was added, we
+               # will need to create the directory
+               if not os.path.exists(self.path):
+                       os.mkdir(self.path, 0777)
+

                self.comments = []
                self.load(article)
 
                self.comments = []
                self.load(article)
 


@@ -761,37 +839,35 @@ class Article (object):
                self._raw_content = ''
                self._comments = []
 
                self._raw_content = ''
                self._comments = []
 

-
-       def get_title(self):
+       @property
+       def title(self):

                if not self.loaded:
                        self.load()
                return self._title
                if not self.loaded:
                        self.load()
                return self._title

-       title = property(fget = get_title)

 
 

-       def get_author(self):
+       @property
+       def author(self):

                if not self.loaded:
                        self.load()
                return self._author
                if not self.loaded:
                        self.load()
                return self._author

-       author = property(fget = get_author)

 
 

-       def get_tags(self):
+       @property
+       def tags(self):

                if not self.loaded:
                        self.load()
                return self._tags
                if not self.loaded:
                        self.load()
                return self._tags

-       tags = property(fget = get_tags)

 
 

-       def get_raw_content(self):
+       @property
+       def raw_content(self):

                if not self.loaded:
                        self.load()
                return self._raw_content
                if not self.loaded:
                        self.load()
                return self._raw_content

-       raw_content = property(fget = get_raw_content)

 
 

-       def get_comments(self):
+       @property
+       def comments(self):

                if not self.loaded:
                        self.load()
                return self._comments
                if not self.loaded:
                        self.load()
                return self._comments

-       comments = property(fget = get_comments)
-

 
        def __cmp__(self, other):
                if self.path == other.path:
 
        def __cmp__(self, other):
                if self.path == other.path:


@@ -896,6 +972,7 @@ class ArticleDB (object):
                self.uuids = {}
                self.actyears = set()
                self.actmonths = set()
                self.uuids = {}
                self.actyears = set()
                self.actmonths = set()

+               self.acttags = set()

                self.load()
 
        def get_articles(self, year = 0, month = 0, day = 0, tags = None):
                self.load()
 
        def get_articles(self, year = 0, month = 0, day = 0, tags = None):


@@ -933,6 +1010,7 @@ class ArticleDB (object):
                                datetime.datetime.fromtimestamp(float(l[1])),
                                datetime.datetime.fromtimestamp(float(l[2])))
                        self.uuids[a.uuid] = a
                                datetime.datetime.fromtimestamp(float(l[1])),
                                datetime.datetime.fromtimestamp(float(l[2])))
                        self.uuids[a.uuid] = a

+                       self.acttags.update(a.tags)

                        self.actyears.add(a.created.year)
                        self.actmonths.add((a.created.year, a.created.month))
                        self.articles.append(a)
                        self.actyears.add(a.created.year)
                        self.actmonths.add((a.created.year, a.created.month))
                        self.articles.append(a)


@@ -967,6 +1045,12 @@ class ArticleDB (object):
                        ml.append(s)
                return ml
 
                        ml.append(s)
                return ml
 

+       def get_tag_links(self):
+               tl = list(self.acttags)
+               tl.sort()
+               return [ '<a href="%s/tag/%s">%s</a>' % (blog_url,
+                               sanitize(t), sanitize(t)) for t in tl ]
+

 #
 # Main
 #
 #
 # Main
 #


@@ -982,7 +1066,7 @@ def render_comments(article, template, form_data):
        if not form_data:
                form_data = CommentFormData()
        form_data.action = blog_url + '/comment/' + article.uuid + '#comment'
        if not form_data:
                form_data = CommentFormData()
        form_data.action = blog_url + '/comment/' + article.uuid + '#comment'

-       captcha = Captcha(article)
+       captcha = captcha_method(article)

        print template.get_comment_form(article, form_data, captcha.puzzle)
 
 def render_html(articles, db, actyear = None, show_comments = False,
        print template.get_comment_form(article, form_data, captcha.puzzle)
 
 def render_html(articles, db, actyear = None, show_comments = False,


@@ -1008,7 +1092,7 @@ def render_artlist(articles, db, actyear = None):
        print template.get_main_header()
        print '<h2>Articles</h2>'
        for a in articles:
        print template.get_main_header()
        print '<h2>Articles</h2>'
        for a in articles:

-               print '<li><a href="%(url)s/uuid/%(uuid)s">%(title)s</a></li>' \
+               print '<li><a href="%(url)s/post/%(uuid)s">%(title)s</a></li>' \

                        % {     'url': blog_url,
                                'uuid': a.uuid,
                                'title': a.title,
                        % {     'url': blog_url,
                                'uuid': a.uuid,
                                'title': a.title,


@@ -1054,9 +1138,9 @@ def render_atom(articles):
     <published>%(ciso)sZ</published>
     <updated>%(uiso)sZ</updated>
     <content type="xhtml">
     <published>%(ciso)sZ</published>
     <updated>%(uiso)sZ</updated>
     <content type="xhtml">

-      <div xmlns="http://www.w3.org/1999/xhtml"><p>
+      <div xmlns="http://www.w3.org/1999/xhtml">

 %(contents)s
 %(contents)s

-      </p></div>
+      </div>

     </content>
   </entry>
                """ % vars
     </content>
   </entry>
                """ % vars


@@ -1134,7 +1218,7 @@ def handle_cgi():
        if atom:
                articles = db.get_articles(tags = tags)
                articles.sort(reverse = True)
        if atom:
                articles = db.get_articles(tags = tags)
                articles.sort(reverse = True)

-               render_atom(articles[:10])
+               render_atom(articles[:index_articles])

        elif style:
                render_style()
        elif post:
        elif style:
                render_style()
        elif post:


@@ -1147,12 +1231,12 @@ def handle_cgi():
                articles = db.get_articles()
                articles.sort(cmp = Article.title_cmp)
                render_artlist(articles, db)
                articles = db.get_articles()
                articles.sort(cmp = Article.title_cmp)
                render_artlist(articles, db)

-       elif comment:
+       elif comment and enable_comments:

                form_data = CommentFormData(author.strip().replace('\n', ' '),
                                link.strip().replace('\n', ' '), captcha,
                                body.replace('\r', ''))
                article = db.get_article(uuid)
                form_data = CommentFormData(author.strip().replace('\n', ' '),
                                link.strip().replace('\n', ' '), captcha,
                                body.replace('\r', ''))
                article = db.get_article(uuid)

-               captcha = Captcha(article)
+               captcha = captcha_method(article)

                redirect = False
                valid = True
                if not form_data.author:
                redirect = False
                valid = True
                if not form_data.author:


@@ -1197,7 +1281,7 @@ def handle_cgi():
                articles = db.get_articles(year, month, day, tags)
                articles.sort(reverse = True)
                if not year and not month and not day and not tags:
                articles = db.get_articles(year, month, day, tags)
                articles.sort(reverse = True)
                if not year and not month and not day and not tags:

-                       articles = articles[:10]
+                       articles = articles[:index_articles]

                render_html(articles, db, year)
 
 
                render_html(articles, db, year)