From b76ee8a96dbf64a4231f749fc9c233518f367ecd Mon Sep 17 00:00:00 2001 From: Joey Hess Date: Wed, 5 Nov 2008 14:22:02 -0500 Subject: minor wording improvements/changes --- doc/plugins/po.mdwn | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) (limited to 'doc/plugins/po.mdwn') diff --git a/doc/plugins/po.mdwn b/doc/plugins/po.mdwn index fe6b6b562..2463680f5 100644 --- a/doc/plugins/po.mdwn +++ b/doc/plugins/po.mdwn @@ -13,7 +13,7 @@ A language is chosen as the "master" one, and any other supported language is a "slave" one. A page written in the "master" language is a "master" page. It can be -of any page type supported by ikiwiki, but PO. It does not have to be +of any page type supported by ikiwiki, except `po`. It does not have to be named a special way: migration to this plugin does not imply any page renaming work. @@ -22,7 +22,7 @@ English; if `usedirs` is enabled, it is rendered as `bla/page/index.en.html`, else as `bla/page.en.html`. Any translation of a "master" page into a "slave" language is called -a "slave" page; it is written in the gettext PO format. PO is now +a "slave" page; it is written in the gettext PO format. `po` is now a page type supported by ikiwiki. Example: `bla/page.fr.po` is the PO "message catalog" used to @@ -56,9 +56,8 @@ The `po_translatable_pages` setting configures what pages are translatable. It is a [[ikiwiki/PageSpec]], so you have lots of control over what kind of pages are translatable. -The PO translations files are anyway not considered as being -translatable, so you don't need to worry about excluding them -explicitly from this [[ikiwiki/PageSpec]]. +The `.po` files are not considered as being translatable, so you don't need to +worry about excluding them explicitly from this [[ikiwiki/PageSpec]]. Internal links -------------- @@ -180,17 +179,14 @@ Additional PageSpec tests This plugin enhances the regular [[ikiwiki/PageSpec]] syntax with some additional tests that are documented [[here|ikiwiki/pagespec/po]]. -Automatic PO files update -------------------------- +Automatic PO file update +------------------------ Committing changes to a "master" page: -1. updates the POT file and the PO files for the supported languages - (this is done in the `needsbuild` hook); the updated PO files are - then put under version control -2. triggers a refresh of the corresponding HTML slave pages (this is - achieved by making any "slave" page dependent on the corresponding - "master" page, in the `needsbuild` hook) +1. updates the POT file and the PO files for the supported languages; + the updated PO files are then put under version control +2. triggers a refresh of the corresponding HTML slave pages Also, when the plugin has just been enabled, or when a page has just been declared as being translatable, the needed POT and PO files are -- cgit v1.2.3 From 7e95723dadfe2a11fcd2463f2e8adf579fdc64db Mon Sep 17 00:00:00 2001 From: Joey Hess Date: Wed, 5 Nov 2008 14:45:45 -0500 Subject: avoid hitting the shell with system() --- IkiWiki/Plugin/po.pm | 3 +-- doc/plugins/po.mdwn | 10 +++++++++- 2 files changed, 10 insertions(+), 3 deletions(-) (limited to 'doc/plugins/po.mdwn') diff --git a/IkiWiki/Plugin/po.pm b/IkiWiki/Plugin/po.pm index 35eed6118..b8c218c5a 100644 --- a/IkiWiki/Plugin/po.pm +++ b/IkiWiki/Plugin/po.pm @@ -149,8 +149,7 @@ sub refreshpofiles ($@) { #{{{ foreach my $pofile (@pofiles) { if (-e $pofile) { - my $cmd = "msgmerge -U --backup=none $pofile $potfile"; - system ($cmd) == 0 + system("msgmerge", "-U", "--backup=none", $pofile, $potfile) == 0 or error("[po/refreshpofiles:$pofile] failed to update"); } else { diff --git a/doc/plugins/po.mdwn b/doc/plugins/po.mdwn index 2463680f5..7ac1b3f0f 100644 --- a/doc/plugins/po.mdwn +++ b/doc/plugins/po.mdwn @@ -205,7 +205,7 @@ Translating One can edit the PO files using ikiwiki's CGI (a message-by-message interface could also be implemented at some point). -If [[tips/untrusted_git_push]] is setup, one can edit the PO files in her +If [[tips/untrusted_git_push]] is setup, one can edit the PO files in one's preferred `$EDITOR`, without needing to be online. TODO @@ -267,6 +267,14 @@ by something like [[todo/using_meta_titles_for_parentlinks]]. Which configuration settings are safe enough for websetup? +> I see no problems with `po_master_language` and `po_slave_languages` +> (assuming websetup handles the hashes correctly). Would not hurt to check +> that the values of these are legal language codes, in `checkconfig`. +> `po_translatable_pages` seems entirely safe. `po_link_to` w/o usedirs +> causes ikiwiki to error out. If it were changed to fall back to a safe +> setting in this case rather than error, it would be safe. +> --[[Joey]] + ### parentlinks When the wiki home page is translatable, the parentlinks plugin sets -- cgit v1.2.3 From 6fbe214d91ca9be37d149a1e5ba11590490959aa Mon Sep 17 00:00:00 2001 From: Joey Hess Date: Wed, 5 Nov 2008 14:47:50 -0500 Subject: fixed one security problem, two more need review --- doc/plugins/po.mdwn | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'doc/plugins/po.mdwn') diff --git a/doc/plugins/po.mdwn b/doc/plugins/po.mdwn index 7ac1b3f0f..ba293f262 100644 --- a/doc/plugins/po.mdwn +++ b/doc/plugins/po.mdwn @@ -227,8 +227,14 @@ Security checks - `refreshpofiles` uses `system()`, whose args have to be checked more thoroughly to prevent any security issue (command injection, etc.). + > Always pass `system()` a list of parameters to avoid the shell. + > I've checked in a change fixing that. --[[Joey]] - `refreshpofiles` and `refreshpot` create new files; this may need some checks, e.g. using `IkiWiki::prep_writefile()` +- Can any sort of directives be put in po files that will + cause mischief (ie, include other files, run commands, crash gettext, + whatever). +- Any security issues on running po4a on untrusted content? gettext/po4a rough corners -------------------------- -- cgit v1.2.3 From b609ae76edf4d18f87643dde3cb6940f8b4f33f1 Mon Sep 17 00:00:00 2001 From: Joey Hess Date: Wed, 5 Nov 2008 14:58:35 -0500 Subject: response --- doc/plugins/po.mdwn | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'doc/plugins/po.mdwn') diff --git a/doc/plugins/po.mdwn b/doc/plugins/po.mdwn index ba293f262..6d468f07e 100644 --- a/doc/plugins/po.mdwn +++ b/doc/plugins/po.mdwn @@ -231,6 +231,10 @@ Security checks > I've checked in a change fixing that. --[[Joey]] - `refreshpofiles` and `refreshpot` create new files; this may need some checks, e.g. using `IkiWiki::prep_writefile()` + > Yes, it would be ideal to call `prep_writefile` on each file + > that they write, beforehand. This way you'd avoid symlink attacks etc to the + > generated po/pot files. I haven't done it, but it seems pretty trivial. + > --[[Joey]] - Can any sort of directives be put in po files that will cause mischief (ie, include other files, run commands, crash gettext, whatever). -- cgit v1.2.3 From fe580240d40b17db3488c22057fdda62ae8a6f85 Mon Sep 17 00:00:00 2001 From: Joey Hess Date: Wed, 5 Nov 2008 15:02:22 -0500 Subject: need license --- doc/plugins/po.mdwn | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'doc/plugins/po.mdwn') diff --git a/doc/plugins/po.mdwn b/doc/plugins/po.mdwn index 6d468f07e..a2e7b18e3 100644 --- a/doc/plugins/po.mdwn +++ b/doc/plugins/po.mdwn @@ -298,6 +298,11 @@ If a given translatable `sourcepage.mdwn` links to \[[destpage]], `sourcepage.LL.po` also link to \[[destpage]], and the latter has the master page *and* all its translations listed in the backlinks. +### license + +> Could you please put a copyright and license on po.pm? I assume it's +> GPLed as it's based on po4a-translate. --[[Joey]] + Translation quality assurance ----------------------------- -- cgit v1.2.3