Fix potential security hole

[bpgallery.git] / bpgallery.sh

diff --git a/bpgallery.sh b/bpgallery.sh
index 8c186bb2f1ed04038b20839cc96d1dd6c5eedf1f..ac776ce79920f1dc30d5973d658d6066bb00998e 100755 (executable)
--- a/bpgallery.sh
+++ b/bpgallery.sh
@@ -19,7 +19,7 @@
 
 set -f
 
 
 set -f
 

-VERSION="1.0.2+arch"
+VERSION="1.0.3"

 
 function bpgallery_default_head() {
 cat <<END
 
 function bpgallery_default_head() {
 cat <<END


@@ -52,7 +52,7 @@ else
        caption_alt=$caption
 fi
 cat << END
        caption_alt=$caption
 fi
 cat << END

-<div class="thumbnail"><a href="$filename"><img src="icons/$filename" alt="$caption_alt" /></a><div class="caption">$caption</div></div>
+<div class="thumbnail"><a href="$link"><img src="icons/$filename" alt="$caption_alt" /></a><div class="caption">$caption</div></div>

 END
 }
 
 END
 }
 


@@ -90,6 +90,23 @@ div.caption {
        font-weight: bold;
 }
 
        font-weight: bold;
 }
 

+div.navigation {
+       width: 100%;
+       margin: 2em;
+       text-align: center;
+}
+
+div.navigation ul {
+       width: 100%;
+       display: inline;
+       text-align: center;
+}
+
+div.navigation ul li {
+       display: inline;
+       margin: 2em;
+}
+

 a {
        border: 0px;
 }
 a {
        border: 0px;
 }


@@ -102,6 +119,37 @@ END
 
 declare -rf bpgallery_default_stylesheet
 
 
 declare -rf bpgallery_default_stylesheet
 

+function bpgallery_default_page() {
+       $BPGALLERY_HEAD_FUNCTION
+       cat <<END
+<h1>${caption}</h1>
+<div class="navigation">
+       <ul>
+               <li><a href='index.html'>Thumbnails</a></li>
+END
+       if [[ ! -z $previouspage ]]; then
+               echo "<li><a href='${previouspage}'>Previous</a></li>"
+       else
+               echo "<li>Previous</li>"
+       fi
+
+       if [[ ! -z $nextpage ]]; then
+               echo "<li><a href='${nextpage}'>Next</a></li>"
+       else
+               echo "<li>Next</li>"
+       fi
+cat <<END
+       </ul>
+</div>
+<div class="mainimage">
+       <img src="${filename}" alt="${caption}" />
+</div>
+END
+       $BPGALLERY_TAIL_FUNCTION
+}
+
+declare -rf bpgallery_default_page
+

 function bpgallery_escape_url() {
        temp=$1
        temp=${temp//\%/%25}
 function bpgallery_escape_url() {
        temp=$1
        temp=${temp//\%/%25}


@@ -150,7 +198,10 @@ if [[ -z ${BPGALLERY_THEME} ]]; then
        BPGALLERY_THEME=default
 fi
 
        BPGALLERY_THEME=default
 fi
 

-if [[ -e $HOME/.bpgallery.themes/${BPGALLERY_THEME} ]]; then
+if [[ ! -z ${BPGALLERY_THEME_DIR} ]] && \
+       [[ -e ${BPGALLERY_THEME_DIR}/${BPGALLERY_THEME} ]]; then
+       . ${BPGALLERY_THEME_DIR}/${BPGALLERY_THEME} 2>/dev/null
+elif [[ -e $HOME/.bpgallery.themes/${BPGALLERY_THEME} ]]; then

        . $HOME/.bpgallery.themes/${BPGALLERY_THEME} 2>/dev/null
 elif [[ -e /usr/local/etc/bpgallery/themes/${BPGALLERY_THEME} ]]; then
        . /usr/local/etc/bpgallery/themes/${BPGALLERY_THEME} 2>/dev/null
        . $HOME/.bpgallery.themes/${BPGALLERY_THEME} 2>/dev/null
 elif [[ -e /usr/local/etc/bpgallery/themes/${BPGALLERY_THEME} ]]; then
        . /usr/local/etc/bpgallery/themes/${BPGALLERY_THEME} 2>/dev/null


@@ -218,6 +269,18 @@ if [[ -z $OUTPUTHTML ]]; then
        OUTPUTHTML=0
 fi
 
        OUTPUTHTML=0
 fi
 

+if [[ -z $GENERATEPAGESFORFULLSIZE ]]; then
+       GENERATEPAGESFORFULLSIZE=0
+fi
+
+if [[ $GENERATEPAGESFORFULLSIZE != 0 ]]; then
+       if declare -F "bpgallery_${BPGALLERY_THEME}_page" > /dev/null ; then
+               BPGALLERY_PAGE_FUNCTION="bpgallery_${BPGALLERY_THEME}_page"
+       else
+               BPGALLERY_PAGE_FUNCTION="bpgallery_default_page"
+       fi
+fi
+

 if declare -F "bpgallery_${BPGALLERY_THEME}_head" > /dev/null ; then
        BPGALLERY_HEAD_FUNCTION="bpgallery_${BPGALLERY_THEME}_head"
 else
 if declare -F "bpgallery_${BPGALLERY_THEME}_head" > /dev/null ; then
        BPGALLERY_HEAD_FUNCTION="bpgallery_${BPGALLERY_THEME}_head"
 else


@@ -296,6 +359,65 @@ function generate_thumbs() {
        $ECHOCOMMAND "Completed generating thumbs for $totalimages images"
 }
 
        $ECHOCOMMAND "Completed generating thumbs for $totalimages images"
 }
 

+function generate_pages() {
+       $ECHOCOMMAND "Generating Pages"
+       previouspage=""
+       currentpage=""
+       nextpage=""
+       previousimage=""
+       currentimage=""
+       nextimage=""
+
+       $FINDCOMMAND . $FINDIMAGESOPTIONS | \
+       $XARGSCOMMAND -0 --replace $ECHOCOMMAND {} | \
+       $SORTCOMMAND -g | \
+       while read imagefilename; do
+               previousimage=$currentimage
+               currentimage=$nextimage
+               nextimage=$imagefilename
+               previouspage=$currentpage
+               currentpage=$nextpage
+               nextpage=${imagefilename}.html
+               filename=${currentimage}
+               generate_general_page "$previouspage" "$currentpage" "$nextpage"
+               echo $nextimage
+       done | tail -n 2 | (
+               read previouspage
+               read currentpage
+               filename=${currentpage}
+               currentpage=${currentpage}.html
+               previouspage=${previouspage}.html
+               nextpage=""
+               generate_general_page "$previouspage" "$currentpage" ""
+       )
+}
+
+
+
+function generate_general_page() {
+
+       if [[ -z $1 ]]; then
+               previouspage=""
+       fi
+
+       if [[ -z $2 ]]; then
+               currentpage=""
+               return
+       fi
+
+       if [[ -z $3 ]]; then
+               nextpage=""
+       fi
+
+       if [ -r captions.txt ]; then
+               caption=$($GREPCOMMAND -E "^${filename}   " captions.txt); caption=${caption#*    }
+       else
+               caption=""
+       fi
+
+       $BPGALLERY_PAGE_FUNCTION > "$currentpage"
+}
+

 if [[ $OUTPUTHTML != 0 ]]; then
        $ECHOCOMMAND "<pre>"
 fi
 if [[ $OUTPUTHTML != 0 ]]; then
        $ECHOCOMMAND "<pre>"
 fi


@@ -329,12 +451,36 @@ if ( ! $FINDCOMMAND . $FINDIMAGESOPTIONS > /dev/null 2>/dev/null ); then
        exit 4
 fi
 
        exit 4
 fi
 

+if [ ! -w . ]; then
+       $ECHOCOMMAND "Can't write to images directory, exiting"
+       exit 8
+fi
+
+if [ -e index.html ] && [ ! -w index.html ]; then
+       $ECHOCOMMAND "Can't write index.html, exiting"
+       exit 8
+fi
+
+if [ -e style.css ] && [ ! -w style.css ]; then
+       $ECHOCOMMAND "Can't write style.css, exiting"
+       exit 8
+fi
+

 if [ ! -d icons ]; then
        mkdir icons
 fi
 
 if [ ! -d icons ]; then
        mkdir icons
 fi
 

+if [ ! -w icons ]; then
+       $ECHOCOMMAND "Can't write to icons directory, exiting"
+       exit 16
+fi
+

 generate_thumbs
 
 generate_thumbs
 

+if [ $GENERATEPAGESFORFULLSIZE != 0 ]; then
+       generate_pages
+fi
+

 if [ -r description.txt ] ; then
        DESCRIPTION=$($SEDCOMMAND -e '1 { s/^/<p>/; }; /^$/ { s,$,</p><p>,; }; $ { s,$,</p>, };' description.txt)
 else
 if [ -r description.txt ] ; then
        DESCRIPTION=$($SEDCOMMAND -e '1 { s/^/<p>/; }; /^$/ { s,$,</p><p>,; }; $ { s,$,</p>, };' description.txt)
 else


@@ -349,7 +495,7 @@ $BPGALLERY_DESCRIPTION_FUNCTION >> index.html
 
 $ECHOCOMMAND "Adding Captions"
 
 
 $ECHOCOMMAND "Adding Captions"
 

-$FINDCOMMAND . $FINDIMAGESOPTIONS | $XARGSCOMMAND -0 --replace $ECHOCOMMAND {} |$SORTCOMMAND -g | while read filename; do filename=${filename#./}; if [ -r captions.txt ]; then caption=$($GREPCOMMAND -E "^$filename  " captions.txt); caption=${caption#*    }; else caption=""; fi; filename=$(bpgallery_escape_url "$filename"); $BPGALLERY_THUMBSLINE_FUNCTION; done >> index.html
+$FINDCOMMAND . $FINDIMAGESOPTIONS | $XARGSCOMMAND -0 --replace $ECHOCOMMAND {} |$SORTCOMMAND -g | while read filename; do filename=${filename#./}; if [ -r captions.txt ]; then caption=$($GREPCOMMAND -E "^$filename  " captions.txt); caption=${caption#*    }; else caption=""; fi; if [ $GENERATEPAGESFORFULLSIZE != 0 ]; then link=$(bpgallery_escape_url "${filename}.html"); else link=$(bpgallery_escape_url "$filename"); fi; filename=$(bpgallery_escape_url "$filename"); $BPGALLERY_THUMBSLINE_FUNCTION; done >> index.html

 
 $BPGALLERY_TAIL_FUNCTION >> index.html
 
 
 $BPGALLERY_TAIL_FUNCTION >> index.html