16 files changed, 226 insertions, 22 deletions

diff --git a/IkiWiki/Plugin/link.pm b/IkiWiki/Plugin/link.pm
index 515a62bce..2ea6aa19e 100644
--- a/IkiWiki/Plugin/link.pm
+++ b/IkiWiki/Plugin/link.pm
@@ -90,8 +90,9 @@ sub renamepage (@) { #{{{
 	$params{content} =~ s{(?<!\\)$link_regexp}{
 		my $linktext=$2;
 		my $link=$linktext;
-		if (bestlink($page, $2) eq $old) {
-			$link=$new;
+		if (bestlink($page, IkiWiki::linkpage($linktext)) eq $old) {
+			$link=IkiWiki::pagetitle($new, 1);
+			$link=~s/ /_/g;
 			if ($linktext =~ m/.*\/*?[A-Z]/) {
 				# preserve leading cap of last component
 				my @bits=split("/", $link);
diff --git a/IkiWiki/Plugin/toggle.pm b/IkiWiki/Plugin/toggle.pm
index 284eb8249..cd9617e25 100644
--- a/IkiWiki/Plugin/toggle.pm
+++ b/IkiWiki/Plugin/toggle.pm
@@ -39,18 +39,22 @@ function toggle(s) {
 		style.display = "none";
 }
 
-function getElementsByClass(class) {
+function getElementsByClass(cls, node, tag) {
+	if (document.getElementsByClass)
+		return document.getElementsByClass(cls, node, tag);
+	if (! node) node = document;
+	if (! tag) tag = '*';
 	var ret = new Array();
-	var pattern = new RegExp("(^|\\s)"+class+"(\\s|$)");
-	var els = document.getElementsByTagName('*');
-	for (i = 0, j = 0; i < els.length; i++) {
+	var pattern = new RegExp("(^|\\s)"+cls+"(\\s|$)");
+	var els = node.getElementsByTagName(tag);
+	for (i = 0; i < els.length; i++) {
 		if ( pattern.test(els[i].className) ) {
-			ret[j] = els[i];
-			j++;
+			ret.push(els[i]);
 		}
 	}
 	return ret;
 }
+
 //-->
 </script>
 EOF
diff --git a/IkiWiki/Rcs/monotone.pm b/IkiWiki/Rcs/monotone.pm
index 97d9c7a30..500af5c58 100644
--- a/IkiWiki/Rcs/monotone.pm
+++ b/IkiWiki/Rcs/monotone.pm
@@ -364,7 +364,28 @@ sub rcs_commit_staged ($$$) {
 	# rcs_remove, and rcs_rename.
 	my ($message, $user, $ipaddr)=@_;
 	
-	error("rcs_commit_staged not implemented for monotone"); # TODO
+	# Note - this will also commit any spurious changes that happen to be
+	# lying around in the working copy.  There shouldn't be any, but...
+	
+	check_config();
+
+	my $author;
+
+	if (defined $user) {
+		$author="Web user: " . $user;
+	}
+	elsif (defined $ipaddr) {
+		$author="Web IP: " . $ipaddr;
+	}
+	else {
+		$author="Web: Anonymous";
+	}
+
+	if (system("mtn", "--root=$config{mtnrootdir}", "commit", "--quiet",
+	           "--author", $author, "--key", $config{mtnkey}, "-m",
+		   possibly_foolish_untaint($message)) != 0) {
+		error("Monotone commit failed");
+	}
 }
 
 sub rcs_add ($) { #{{{
@@ -381,13 +402,30 @@ sub rcs_add ($) { #{{{
 sub rcs_remove ($) { # {{{
 	my $file = shift;
 
-	error("rcs_remove not implemented for monotone"); # TODO
+	check_config();
+
+	# Note: it is difficult to undo a remove in Monotone at the moment.
+	# Until this is fixed, it might be better to make 'rm' move things
+	# into an attic, rather than actually remove them.
+	# To resurrect a file, you currently add a new file with the contents
+	# you want it to have.  This loses all connectivity and automated
+	# merging with the 'pre-delete' versions of the file.
+
+	if (system("mtn", "--root=$config{mtnrootdir}", "rm", "--quiet",
+	           $file) != 0) {
+		error("Monotone remove failed");
+	}
 } #}}}
 
 sub rcs_rename ($$) { # {{{
 	my ($src, $dest) = @_;
 
-	error("rcs_rename not implemented for monotone"); # TODO
+	check_config();
+
+	if (system("mtn", "--root=$config{mtnrootdir}", "rename", "--quiet",
+	           $src, $dest) != 0) {
+		error("Monotone rename failed");
+	}
 } #}}}
 
 sub rcs_recentchanges ($) { #{{{
@@ -498,7 +536,26 @@ sub rcs_recentchanges ($) { #{{{
 } #}}}
 
 sub rcs_diff ($) { #{{{
-	# TODO
+	my $rev=shift;
+	my ($sha1) = $rev =~ /^($sha1_pattern)$/; # untaint
+	
+	check_config();
+
+	my $child = open(MTNDIFF, "-|");
+	if (! $child) {
+		exec("mtn", "diff", "--root=$config{mtnrootdir}", "-r", "p:".$sha1, "-r", $sha1) || error("mtn diff $sha1 failed to run");
+	}
+
+	my (@lines) = <MTNDIFF>;
+
+	close MTNDIFF || debug("mtn diff $sha1 exited $?");
+
+	if (wantarray) {
+		return @lines;
+	}
+	else {
+		return join("", @lines);
+	}
 } #}}}
 
 sub rcs_getctime ($) { #{{{
diff --git a/debian/changelog b/debian/changelog
index 3e6fba586..f6137d72f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -25,6 +25,8 @@ ikiwiki (2.55) UNRELEASED; urgency=low
     templates.
   * attachment: Do not escape _ when determining attachment filenames.
   * Rebuild pages that change their type. (Gabriel McManus)
+  * monotone: Add support for rename, delete, and also diff. (William Uther)
+  * toggle: Fix incompatability between javascript and webkit.
 
  -- Joey Hess <joeyh@debian.org>  Mon, 21 Jul 2008 11:35:46 -0400
 
diff --git a/doc/bugs/attachment:_escaping_underscores_in_filename__63__.mdwn b/doc/bugs/attachment:_escaping_underscores_in_filename__63__.mdwn
index d7d101700..4ce4ac5ee 100644
--- a/doc/bugs/attachment:_escaping_underscores_in_filename__63__.mdwn
+++ b/doc/bugs/attachment:_escaping_underscores_in_filename__63__.mdwn
@@ -17,3 +17,6 @@ Is it a bug or security feature? --[[Paweł|ptecza]]
 >> (`myisam__95__vs__95__ndb` instead of `myisam_vs_ndb`).  --[[Paweł|ptecza]]
 
 > [[done]], uses `linkpage` now.
+
+>> It's seems that now Ikiwiki doesn't escape the filenames with underscore(s).
+>> Thank you very much for the fast fix! --[[Paweł|ptecza]]
diff --git a/doc/bugs/markdown_bug:_email_escaping_and_plus_addresses.mdwn b/doc/bugs/markdown_bug:_email_escaping_and_plus_addresses.mdwn
new file mode 100644
index 000000000..8efd6da57
--- /dev/null
+++ b/doc/bugs/markdown_bug:_email_escaping_and_plus_addresses.mdwn
@@ -0,0 +1,36 @@
+compare:
+
+    * <jon+markdownbug@example.org>
+    * <jon.markdownbug@example.org>
+
+* <jon+markdownbug@example.org>
+* <jon.markdownbug@example.org>
+
+It seems putting a '+' in there throws it. Maybe it's a markdown bug, or maybe the obfuscation markdown applies to email-links is being caught by the HTML sanitizer.
+
+ -- [[JonDowland]]
+
+> It's a markdown bug. For some reason, markdown doesn't recognize the email with a '+' as an email:
+>
+>     $ echo '<a+b@c.org>' | markdown
+>     <p><a+b@c.org></p>
+>
+> htmlscrubber then (rightly) removes this unknown tag.
+>
+
+>> Filed [in CPAN](http://rt.cpan.org/Ticket/Display.html?id=37909) --[[Joey]] [[tag done]]
+
+> But I've noticed some other Text::Markdown bugs that, even with htmlscrubber, produce
+> [ill-formed (X)HTML](http://validator.w3.org/check?uri=http%3A%2F%2Fikiwiki.info%2Fbugs%2Fmarkdown_bug%3A_email_escaping_and_plus_addresses%2F).
+> (View the markdown source of this page.)
+>
+> --Gabriel
+
+>> The htmlscrubber does not attempt to produce valid html from invalid. It
+>> attempts to prevent exploits in html. The tidy plugin can force html to
+>> valid. --[[Joey]]
+
+<tt>
+
+- 
+>
diff --git a/doc/bugs/ssl_certificates_not_checked_with_openid.mdwn b/doc/bugs/ssl_certificates_not_checked_with_openid.mdwn
index cb4c706f0..e3bd56cfd 100644
--- a/doc/bugs/ssl_certificates_not_checked_with_openid.mdwn
+++ b/doc/bugs/ssl_certificates_not_checked_with_openid.mdwn
@@ -12,6 +12,10 @@ For now, I want to try and resolve the issues with net\_ssl\_test, and run more
 > ikiwiki) performing any sanity checking of the openid server. All the
 > security authentication goes on between your web browser and the openid
 > server. This may involve ssl, or not.
+>
+>> Note that I'm not an openid expert, and the above may need to be taken
+>> with a grain of salt. I also can make no general statements about openid
+>> being secure. ;-) --[[Joey]]
 > 
 > For example, my openid is "http://joey.kitenet.net/". If I log in with
 > this openid, ikiwiki connects to that http url to determine what openid
@@ -34,3 +38,15 @@ For now, I want to try and resolve the issues with net\_ssl\_test, and run more
 >> for use by ikiwiki and the rest is simple.
 
 >> -- Brian May
+
+>>> I guess that the place to add SSL cert checking would be in either
+>>> [[cpan LWPx::ParanoidAgent]] or [[cpan Net::OpenID::Consumer]]. Adding
+>>> it to ikiwiki itself, which is just a user of those libraries, doesn't
+>>> seem right.
+>>> 
+>>> It's not particularly clear to me how a SSL cert can usefully be
+>>> checked at this level, where there is no way to do anything but
+>>> succeed, or fail; and where the extent of the check that can be done is
+>>> that the SSL cert is issued by a trusted party and matches the domain name
+>>> of the site being connected to. I also don't personally think that SSL
+>>> certs are the right fix for DNS poisoning issues. --[[Joey]]
diff --git a/doc/bugs/toggle_fails_on_Safari.mdwn b/doc/bugs/toggle_fails_on_Safari.mdwn
new file mode 100644
index 000000000..25f62e088
--- /dev/null
+++ b/doc/bugs/toggle_fails_on_Safari.mdwn
@@ -0,0 +1,58 @@
+The [[plugins/toggle]] plugin has no effect when viewed on the Safari web browser.
+
+All toggles appear open all the time.
+
+I don't know if this is true for other webkit browsers (the new Konqueror, the iPhone, etc).
+I'm currently testing in the Safari nightly builds, but I've seen the bug in the current release
+of Safari too.
+
+Looking at the Safari Web Inspector, it believes there is a parse error on line 47 of the
+[[news]] page.  This is the definition of the getElementsByClass(class) function.
+
+    45 }
+    46
+    47 function getElementsByClass(class) {
+       SyntaxError: Parse error
+    48 	var ret = new Array();
+
+> Reproduced in epiphany-webkit on debian.
+> 
+> Also noticed something interesting when I opened the page in vim. It
+> highlighted the "class" like a type definition, not a variable. Sure
+> enough, replacing with "c" fixed it.
+> 
+> I wonder if webkit is actually in the right here, and using a reseved
+> word like, presumably, "class" as a variable name is not legal. As I try
+> to ignore javascript as much as possible, I can't say. [[done]] --[[Joey]]
+
+>> I also started having a look at this.  I found the same issue with the
+>> the variable 'class'.  I'm not a javascript guru so I looked on the web
+>> at other implementations of getElementsByClass() and noticed some
+>> things that we might use.  I took a bunch of different ideas and came
+>> up with this:
+
+    function getElementsByClass(cls, node, tag) {
+    	if (document.getElementsByClass)
+    		return document.getElementsByClass(cls, node, tag);
+    	if (! node) node = document;
+    	if (! tag) tag = '*';
+    	var ret = new Array();
+    	var pattern = new RegExp("(^|\\s)"+cls+"(\\s|$)");
+    	var els = node.getElementsByTagName(tag);
+    	for (i = 0; i < els.length; i++) {
+    		if ( pattern.test(els[i].className) ) {
+    			ret.push(els[i]);
+    		}
+    	}
+    	return ret;
+    }
+
+>> Most of the changes are minor, except that this one will use the
+>> built in function if it is available.  That is likely to be significantly
+>> faster.  Adding the extra parameters doesn't cause a problem --
+>> they're filled in with useful defaults.
+
+>> I don't know if it is worth making this change, but it is there if you want it.
+
+>>> Well, it seems to work. Although god only knows about IE. Suppose I
+>>> might as well.. --[[Joey]]
diff --git a/doc/download.mdwn b/doc/download.mdwn
index e35cc0a45..98defb382 100644
--- a/doc/download.mdwn
+++ b/doc/download.mdwn
@@ -24,8 +24,8 @@ Or download the deb from <http://packages.debian.org/unstable/web/ikiwiki>.
 There is a backport of a recent version of ikiwiki for Debian 4.0 at
 <http://packages.debian.org/etch-backports/ikiwiki>.
 
-There is also an unofficial backport of ikiwiki for Ubuntu Gutsy
-and Ubuntu Hardy, provided by Paweł Tęcza,
+There is also an unofficial backport of ikiwiki for Ubuntu Hardy, provided by
+[[Paweł_Tęcza|users/ptecza]],
 at [http://gpa.net.icm.edu.pl/ubuntu/](http://gpa.net.icm.edu.pl/ubuntu/index-en.html).
 
 FreeBSD has ikiwiki in its
diff --git a/doc/todo/Bestdir_along_with_bestlink_in_IkiWiki.pm/discussion.mdwn b/doc/todo/Bestdir_along_with_bestlink_in_IkiWiki.pm/discussion.mdwn
new file mode 100644
index 000000000..d473bc3ad
--- /dev/null
+++ b/doc/todo/Bestdir_along_with_bestlink_in_IkiWiki.pm/discussion.mdwn
@@ -0,0 +1,6 @@
+- Is there some implicit license for patches posted on the wiki?
+  I would like to maybe use this in [[todo/mbox]]  --[[DavidBremner]]
+
+> If it's not clear to me that a patch is a derivative work of ikiwiki, I
+> always ask for a license clarification before adding it to ikiwiki.
+> --[[Joey]]
diff --git a/doc/todo/Moving_Pages.mdwn b/doc/todo/Moving_Pages.mdwn
index 61f2663e0..bd6507dd0 100644
--- a/doc/todo/Moving_Pages.mdwn
+++ b/doc/todo/Moving_Pages.mdwn
@@ -205,3 +205,16 @@ Cases to consider:
   Update: Meh. It's certianly not ideal; if Bob tries to save the page he
   uploaded the attachment to, he'll get a message about it having been
   deleted/renamed, and he can try to figure out what to do... :-/
+* I don't know if this is a conflict, but it is an important case to consider;
+  you need to make sure that there are no security holes.  You dont want
+  someone to be able to rename something to <code>/etc/passwd</code>.
+  I think it would be enough that you cannot rename to a location outside
+  of srcdir, you cannot rename to a location that you wouldn't be able
+  to edit because it is locked, and you cannot rename to an existing page.
+
+  > Well, there are a few more cases (like not renaming to a pruned
+  > filename, and not renaming _from_ a file that is not a known source
+  > file or is locked), but yes, that's essentially it.
+  > 
+  > PS, the first thing I do to any
+  > web form is type /etc/passwd and ../../../../etc/passwd into it. ;-) --[[Joey]]
diff --git a/doc/todo/done.mdwn b/doc/todo/done.mdwn
index ed161fb5b..7fcbe44b6 100644
--- a/doc/todo/done.mdwn
+++ b/doc/todo/done.mdwn
@@ -1,3 +1,3 @@
 recently fixed [[TODO]] items
 
-[[!inline pages="link(todo/done) and !todo and !*/Discussion" sort=mtime show=10]]
+[[!inline pages="link(todo/done) and !todo and !*/Discussion" sort=mtime show=10 archive=yes]]
diff --git a/doc/todo/mercurial.mdwn b/doc/todo/mercurial.mdwn
index 77b538c02..f0dbf9806 100644
--- a/doc/todo/mercurial.mdwn
+++ b/doc/todo/mercurial.mdwn
@@ -1,4 +1,3 @@
-* rcs_notify is not implemented (not needed in this branch --[[Joey]])
 * Is the code sufficiently robust? It just warns when mercurial fails.
 * When rcs_commit is called with a $user that is an openid, it will be
   passed through to mercurial -u. Will mercurial choke on this?
diff --git a/doc/todo/rcs_updates_needed_for_rename_and_remove.mdwn b/doc/todo/rcs_updates_needed_for_rename_and_remove.mdwn
index 02c935b4f..412f94804 100644
--- a/doc/todo/rcs_updates_needed_for_rename_and_remove.mdwn
+++ b/doc/todo/rcs_updates_needed_for_rename_and_remove.mdwn
@@ -1,5 +1,5 @@
 I've added three new functions to the ikiwiki VCS interface to support
-renaming and removing files using the web interface. The bzr, mercurial,
-monotone, and tla [[rcs]] backends need implementions of these functions.
+renaming and removing files using the web interface. The bzr,
+mercurial, and tla [[rcs]] backends need implementions of these functions.
 
 (The maintainers of these backends have been mailed. --[[Joey]])
diff --git a/doc/users/ptecza.mdwn b/doc/users/ptecza.mdwn
index 97d63ab94..3f6fd39e8 100644
--- a/doc/users/ptecza.mdwn
+++ b/doc/users/ptecza.mdwn
@@ -13,6 +13,9 @@ but now I rather prefer Ubuntu, because it has faster release cycle
 than Debian and I don't want to wait more then 1 year for new stable
 release.
 
-I'm also author of ikiwiki backports for Debian 'sarge'. You can find
-this and another my backports at
-[public GPA's Debian packages archive](http://gpa.net.icm.edu.pl/debian/).
+I'm also author of unofficial ikiwiki backports. In the past I was
+rebuilding ikiwiki source package for Debian Sarge and Ubuntu Gutsy.
+Now I do the same for Ubuntu Hardy. You can find this and another
+my backports at [public GPA's Ubuntu packages archive](http://gpa.net.icm.edu.pl/ubuntu/).
+
+I love using Ikiwiki and bug reporting ;)
diff --git a/t/renamepage.t b/t/renamepage.t
index ccb33d817..a706cbb46 100755
--- a/t/renamepage.t
+++ b/t/renamepage.t
@@ -1,7 +1,7 @@
 #!/usr/bin/perl
 use warnings;
 use strict;
-use Test::More tests => 15;
+use Test::More tests => 21;
 use Encode;
 
 BEGIN { use_ok("IkiWiki"); }
@@ -43,3 +43,9 @@ is(try("z", "foo" => "bar", "[[foo#anchor]]"), "[[bar#anchor]]"); # with anchor
 is(try("z", "foo" => "bar", "[[xxx|foo#anchor]]"), "[[xxx|bar#anchor]]"); # with anchor
 is(try("z", "foo" => "bar", "[[!moo ]]"), "[[!moo ]]"); # preprocessor directive unchanged
 is(try("bugs", "bugs/foo" => "wishlist/bar", "[[foo]]"), "[[wishlist/bar]]"); # subpage link
+is(try("z", "foo_bar" => "bar", "[[foo_bar]]"), "[[bar]]"); # old link with underscore
+is(try("z", "foo" => "bar_foo", "[[foo]]"), "[[bar_foo]]"); # new link with underscore
+is(try("z", "foo_bar" => "bar_foo", "[[foo_bar]]"), "[[bar_foo]]"); # both with underscore
+is(try("z", "foo" => "bar__".ord("(")."__", "[[foo]]"), "[[bar(]]"); # new link with escaped chars
+is(try("z", "foo__".ord("(")."__" => "bar(", "[[foo(]]"), "[[bar(]]"); # old link with escaped chars
+is(try("z", "foo__".ord("(")."__" => "bar__".ord(")")."__", "[[foo(]]"), "[[bar)]]"); # both with escaped chars