fix other cases of unicode mixing issue

and fix underlaydir override attack guard when srcdir is non-absolute

2 files changed, 19 insertions, 8 deletions

diff --git a/IkiWiki/Plugin/autoindex.pm b/IkiWiki/Plugin/autoindex.pm
index 0dd76259e..5e8a9e0a3 100644
--- a/IkiWiki/Plugin/autoindex.pm
+++ b/IkiWiki/Plugin/autoindex.pm
@@ -33,18 +33,19 @@ sub genindex ($) {
 sub refresh () {
 	eval q{use File::Find};
 	error($@) if $@;
+	eval q{use Cwd};
+	error($@) if $@;
+	my $origdir=getcwd();
 
 	my (%pages, %dirs);
 	foreach my $dir ($config{srcdir}, @{$config{underlaydirs}}, $config{underlaydir}) {
-		require File::Spec;
-		$dir=File::Spec->canonpath($dir);
+		chdir($dir) || die "chdir: $!";
 
 		find({
 			no_chdir => 1,
 			wanted => sub {
-				my $file=File::Spec->canonpath(decode_utf8($_));
-				return if $file eq $dir;
-				$file=~s/^\Q$dir\E\/?//;
+				my $file=decode_utf8($_);
+				$file=~s/^\.\/?//;
 				return unless length $file;
 				if (IkiWiki::file_pruned($file)) {
 					$File::Find::prune=1;
@@ -61,7 +62,9 @@ sub refresh () {
 					}
 				}
 			}
-		}, $dir);
+		}, '.');
+
+		chdir($origdir) || die "chdir: $!";
 	}
 	
 	my %deleted;
diff --git a/IkiWiki/Plugin/comments.pm b/IkiWiki/Plugin/comments.pm
index d204a7737..17cd99c3b 100644
--- a/IkiWiki/Plugin/comments.pm
+++ b/IkiWiki/Plugin/comments.pm
@@ -660,16 +660,22 @@ sub comments_pending () {
 
 	eval q{use File::Find};
 	error($@) if $@;
+	eval q{use Cwd};
+	error($@) if $@;
+	my $origdir=getcwd();
 
 	my $find_comments=sub {
 		my $dir=shift;
 		my $extension=shift;
 		return unless -d $dir;
+
+		chdir($dir) || die "chdir: $!";
+
 		find({
 			no_chdir => 1,
 			wanted => sub {
 				my $file=decode_utf8($_);
-				$file=~s/^\Q$dir\E\/?//;
+				$file=~s/^\.\///;
 				return if ! length $file || IkiWiki::file_pruned($file)
 					|| -l $_ || -d _ || $file !~ /\Q$extension\E$/;
 				my ($f) = $file =~ /$config{wiki_file_regexp}/; # untaint
@@ -678,7 +684,9 @@ sub comments_pending () {
 					push @ret, [$f, $dir, $ctime];
 				}
 			}
-		}, $dir);
+		}, ".");
+
+		chdir($origdir) || die "chdir: $!";
 	};
 	
 	$find_comments->($config{srcdir}, "._comment_pending");