Makefile

@@ -14,7 +14,6 @@ SOURCES+=$(wildcard handlers/*.cpp)
 SOURCES+=$(wildcard database/*.cpp)
 SOURCES+=$(wildcard cache/*.cpp)
 SOURCES+=$(wildcard sandbox/*.cpp)
-SOURCES+=$(wildcard dynamic/*.cpp)
 
 HEADERS=$(wildcard *.h)
 HEADERS+=$(wildcard gateway/*.h)
@@ -22,7 +21,7 @@ HEADERS+=$(wildcard handlers/*.h)
 HEADERS+=$(wildcard database/*.h)
 HEADERS+=$(wildcard cache/*.h)
 HEADERS+=$(wildcard sandbox/*.h)
-HEADERS+=$(wildcard dynamic/*.h)
+
 
 OBJECTS=$(patsubst %.cpp, %.o, $(SOURCES))
 WIKIOBJECTS=$(filter-out test.o, $(OBJECTS))
@@ -49,12 +48,8 @@ profile: LDFLAGS+= -pg
 release: qswiki
 profile: qswiki
 
-
-exile.o: submodules/exile.h/exile.c
-	$(CC) -std=c99 -DHAVE_LANDLOCK=0 -c submodules/exile.h/exile.c -o exile.o
-
-qswiki: $(WIKIOBJECTS) exile.o
-	$(CXX) $(WIKIOBJECTS) exile.o ${LDFLAGS} ${INCLUDEFLAGS}  -o qswiki
+qswiki: $(WIKIOBJECTS)
+	$(CXX) $(WIKIOBJECTS) ${LDFLAGS} ${INCLUDEFLAGS}  -o qswiki
 
 test: $(TESTOBJECTS)
 	$(CXX) $(TESTOBJECTS) ${LDFLAGS} -o test
@@ -68,6 +63,6 @@ gtest: $(GTESTS_TESTDIR)/*.cpp $(GTEST_OBJECTS)
 version.o:version.cpp
 	$(CXX) ${CXXFLAGS} ${INCLUDEFLAGS} -DGITCOMMIT=\"$(shell git rev-parse --short HEAD)\" -c -o $@ $<
 clean:
-	rm -f exile.o $(OBJECTS) $(DEPENDS)
+	rm -f $(OBJECTS) $(DEPENDS)
 
 

dynamic/dynamiccontentpostlist.cpp

@@ -12,7 +12,6 @@ std::string DynamicContentPostList::render()
 	auto pageDao = this->database->createPageDao();
 	auto revisionDao = this->database->createRevisionDao();
 	QueryOption option;
-	option.includeInvisible = false;
 	auto members = categoryDao->fetchMembers(this->catname, option);
 	std::vector<std::pair<std::string, time_t>> pageList;
 	for(std::string &member : members)

sandbox/sandbox-linux.cpp

@@ -12,13 +12,18 @@
 #include <filesystem>
 #include <sys/mount.h>
 #include <sys/capability.h>
-#include <exile.hpp>
+#define HAVE_LANDLOCK 0
+#include <exile.h>
 #include "../logger.h"
 #include "../utils.h"
 #include "../random.h"
 
 #include "sandbox-linux.h"
 
+/* TODO: make a whitelist approach. So far we simply blacklist
+ * obvious systemcalls. To whitelist, we need to analyse our
+ * dependencies (http library, sqlite wrapper, sqlite lib etc.) */
+
 bool SandboxLinux::supported()
 {
 	std::fstream stream;
@@ -49,19 +54,19 @@ bool SandboxLinux::enable(std::vector<std::string> fsPaths)
 	}
 	for(unsigned int i = 0; i < fsPaths.size(); i++)
 	{
-		exile_append_path_policies(policy, EXILE_FS_ALLOW_ALL_READ | EXILE_FS_ALLOW_ALL_WRITE, fsPaths[i].c_str());
+		exile_append_path_policy(policy, EXILE_FS_ALLOW_ALL_READ | EXILE_FS_ALLOW_ALL_WRITE, fsPaths[i].c_str());
 	}
 	policy->drop_caps = 1;
 	policy->not_dumpable = 1;
 	policy->no_new_privs = 1;
 	policy->mount_path_policies_to_chroot = 1;
 	policy->vow_promises = EXILE_SYSCALL_VOW_STDIO | EXILE_SYSCALL_VOW_WPATH | EXILE_SYSCALL_VOW_CPATH |
-						   EXILE_SYSCALL_VOW_RPATH | EXILE_SYSCALL_VOW_INET | EXILE_SYSCALL_VOW_UNIX |
-						   EXILE_SYSCALL_VOW_THREAD;
+							  EXILE_SYSCALL_VOW_RPATH | EXILE_SYSCALL_VOW_INET | EXILE_SYSCALL_VOW_UNIX |
+							  EXILE_SYSCALL_VOW_THREAD;
 
 	if(exile_enable_policy(policy) != 0)
 	{
-		Logger::error() << "Sandbox: Activation of exile failed!";
+		Logger::error() << "Sandbox: Activation of seccomp blacklist failed!";
 		exile_free_policy(policy);
 		return false;
 	}

submodules/exile.h

@@ -1 +1 @@
-Subproject commit f2ca26010a2bb6d9e270d6ade2e8789c02ac3b31
+Subproject commit 4824c6eaa9043878daaba7b3778338f5bf913f06

template/quitesimple/dynamic/postlistbegin

@@ -1 +0,0 @@
-<ul>

template/quitesimple/dynamic/postlistend

@@ -1 +0,0 @@
-</ul>

template/quitesimple/dynamic/postlistlink

@@ -1 +0,0 @@
-<li>{date}: <a href="{url}">{title}</a></li>

template/quitesimple/feeds/atomentry

@@ -1,7 +0,0 @@
-<entry>
-    <title>{qswiki:var:entrytitle}</title>
-    <link href="{qswiki:var:entryurl}"/>
-    <id>{qswiki:var:entryid}</id>
-    <published>{qswiki:var:entrypublished}</published>
-    <content type="html">{qswiki:var:entrycontent}</content>
-</entry>

template/quitesimple/feeds/atomfooter

@@ -1 +0,0 @@
-</feed>

template/quitesimple/feeds/atomheader

@@ -1,8 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<feed xmlns="http://www.w3.org/2005/Atom">
-  <author>
-    <name>{qswiki:config:wikiownername}</name>
-  </author>
-  <title>{qswiki:config:wikiname} - {qswiki:var:subtitle}</title>
-  <id>{qswiki:var:atomfeeduniqueid}</id>
-  <updated>{qswiki:var:atomfeedupdate}</updated>