Wiki system should validate page name to create, rename and import

[Jun Omae]

Reproduce invalid renaming using browser

1. Show wiki:WikiStart.
2. Click "Rename page" button
3. Enter "..////WikiStart" as new page name and submit.
4. Error "No handler matched request to /WikiStart" happens.
5. wiki:TitleIndex lists "..////WikiStart" page.

Reproduce invalid creating page name using ​w3m

1. Launch w3m browser.
2. Enter url http://localhost/trac/wiki/../Test.
3. Click "Create this page" button.
4. Enter wiki contents and save the page
5. w3m can access http://localhost/trac/wiki/../Test, however other browsers cannot access this url.

Reproduce invalid renaming and importing using trac-admin

Try the following commands.

Trac [/var/trac/0.12-stable]> wiki rename WikiStart ../WikiStart
Trac [/var/trac/0.12-stable]> wiki import PageTemplates/////slashes /etc/hosts
Trac [/var/trac/0.12-stable]> wiki import ../invalid-wikipage/.. /etc/hosts
Trac [/var/trac/0.12-stable]> wiki import ././././. /etc/hosts

Sorry, no patch.

[Remy Blank]

You're doing some nasty things with your wiki ;) Do you mean, no patch… yet?

[Jun Omae]

Do you mean, no patch… yet?

I mean that I only report the issue and do not begin to work it.

[Remy Blank]

Replying to jomae:

I mean that I only report the issue and do not begin to work it.

Ok, then we'll schedule this for a later milestone.

[Jun Omae]

I worked for the issue on changeset/t10274-wrong-wiki-name/jomae.

1. Added validate_page_name in trac.wiki.api, validator for Wiki page name.
2. Added validations for wiki name in WikiPage.save() and WikiPage.rename().
3. When a user rename to invalid wiki name (e.g. ../WikiStart), Trac blocks the renaming and shows a warning.
4. When a user access the invalid wiki name (e.g. ​http://localhost/wiki/WikiStart%2f..%2f..%2fvar), Trac raises TracError.

Thoughts? Should we use _resolve_relative_name for a new page name on the renaming?

[Remy Blank]

Replying to jomae:

Thoughts?

The changes look fine (I only did a quick read). Good work!

Should we use _resolve_relative_name for a new page name on the renaming?

I have a small preference for not resolving the new page name as a relative name, because it seems that people already have trouble understanding the relative names, so I would rather keep things explicit.

[Jun Omae]

Replying to rblank:

I have a small preference for not resolving the new page name as a relative name, because it seems that people already have trouble understanding the relative names, so I would rather keep things explicit.

Thanks for your comments! I also think it need not the resolving. Committed in r10786 without additional changes.