thunix
/
wiki
3
1
Fork 5
Code Issues Pull Requests 1 Releases Wiki Activity

Compare commits

base: thunix:abf209326c76fc31351a04cf44ffadda1339c2f0
Branches Tags
thunix:master
thunix:toc
thunix:dev
...
compare: thunix:8d5275e3a47196322922ebaf707c051f024e82a8
Branches Tags
thunix:master
thunix:toc
thunix:dev

6 Commits
abf209326c ... 8d5275e3a4

Author SHA1 Message Date
Blade of Darkness 8d5275e3a4 could return 403 instead 2021-03-20 18:53:06 +01:00
southerntofu 549e014daa Don't output anything only 403 on fishy request 2021-03-20 18:33:58 +01:00
southerntofu 6d6093990d Minimal README with nginx example config 2021-03-20 18:31:16 +01:00
southerntofu 79b32dda8e You can't escape the webroot 2021-03-20 17:53:54 +01:00
southerntofu 708dc5a3f1 Handle 404 gracefully 2021-03-20 17:43:07 +01:00
southerntofu 3c0a380ce3 Remove hardcoded paths to local files 2021-03-20 17:36:39 +01:00
4 changed files with 43 additions and 12 deletions
Show Stats Expand all files Collapse all files

26
README.md Normal file
View File

@ -0,0 +1,26 @@
# thunix wiki
Requires a webserver and PHP. The web server needs to be configured to:
- serve wiki.php by default (not index.php)
- when a requested URL does not correspond to an actual file, pass the requested page to wiki.php?page=
On apache, this is achieved by provided [.htaccess](.htaccess). On nginx, you can do something like:
```
server {
listen 80;
root /var/www/wiki_webroot;
index wiki.php;
server_name _;
location ~ \.php$ {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/var/run/php/php7.3-fpm.sock;
}
location ~ ^/(.+)$ {
try_files $uri $uri/ /wiki.php?page=$1;
}
}
```

3
config.php
View File

@ -5,7 +5,4 @@ $site_name="Thunix Wiki";
//Root for the site, in a browser
$site_root="https://wiki.thunix.net";
//Local base root for app files
$doc_root="/var/www/wiki.thunix.net/";
?>

3
includes/404.md Normal file
View File

@ -0,0 +1,3 @@
# 404
This page ("$page") does not exist.

23
wiki.php
View File

@ -7,23 +7,28 @@ Parsedown is licensed under the MIT license.
include('config.php');
include('parsedown-1.7.3/Parsedown.php');
$page = $_GET['page'];
$page = isset($_GET['page']) ? $_GET['page'] : 'main';
// Sanitize page request so we don't allow to read EVERY markdown file
// for example ../../../home/foobar/mysecretdocument
if (strpos($page, "../") !== false) {
header('HTTP/1.0 403 Forbidden');
exit();
}
$content_file = "articles/$page.md";
$Parsedown = new Parsedown();
$Parsedown->setSafeMode(true);
if ( $page == "") {
$page = "main";
}
if(isset($_GET['style']))
$site_style = $_GET['style'];
else
$site_style="site";
$header = file_get_contents("$doc_root/includes/header.md");
$sidebar = file_get_contents("$doc_root/includes/sidebar.md");
$content = file_get_contents("$doc_root/articles/$page.md");
$footer = file_get_contents("$doc_root/includes/footer.md");
$header = file_get_contents("includes/header.md");
$sidebar = file_get_contents("includes/sidebar.md");
$content = file_exists($content_file) ? file_get_contents($content_file) : str_replace('$page', "$page", file_get_contents("includes/404.md"));
$footer = file_get_contents("includes/footer.md");
print "<!DOCTYPE html>
<html lang='en'>