use werkzeug safe_join to sanitize the requested path

no tests changed, so my implementation might have been good, but let's
use the provided check

CONTRIBUTING.md

@@ -1,7 +1,10 @@
 # How to Contribute
 
 incorporeal-cms is a personal project seeking to implement a simpler, cleaner form of what would
-commonly be called a "CMS". I appreciate any help in making incorporeal-cms better.
+commonly be called a "CMS". I appreciate any help in making it better.
+
+incorporeal-cms is made available under the GNU Affero General Public License version 3, or any
+later version.
 
 ## Opening Issues
 
@@ -10,8 +13,24 @@ Issues should be posted to my Gitea instance at
 recommend starting the title with "Improvement:", "Bug:", or similar, so I can do a high level of
 prioritization.
 
-## Guidelines for Patches, etc.
+## Contributions
 
+I don't expect contributors to sign up for my personal Gitea in order to send contributions, but it
+of course makes it easier. If you wish to go this route, please sign up at
+<https://git.incorporeal.org/bss/incorporeal-cms> and fork the project. People planning on
+contributing often are also welcome to request access to the project directly.
+
+Otherwise, contact me via any means you know to reach me at, or <bss@incorporeal.org>, to discuss
+your change and to tell me how to pull your changes.
+
+### Guidelines for Patches, etc.
+
+* Cloning
+    * Clone the project. I would advise using a pull-based workflow where I have access to the hosted
+      repository --- using my Gitea, cloning to a public GitHub, etc. --- rather than doing this over
+      email, but that works too if we must.
+    * Make your contributions in a new branch, generally off of `master`.
+    * Send me a pull request when you're ready, and we'll go through a code review.
 * Code:
     * Keep in mind that I strive for simplicity in the software. It serves files and renders
       Markdown, that's pretty much it. Features around that function are good; otherwise, I need
@@ -27,22 +46,31 @@ prioritization.
     * Squash tiny commits if you'd like. I prefer commits that make one atomic conceptual change
       that doesn't affect the rest of the code, assembling multiple of those commits into larger
       changes.
-    * Follow something like [Chris Beams'](https://chris.beams.io/posts/git-commit/) post on
+    * Follow something like [Chris Beams's post](https://chris.beams.io/posts/git-commit/) on
       formatting a good commit message.
+    * Please make sure your Author contact information is stable, in case I need to reach you.
+    * Consider cryptographically signing (`git commit -S`) your commits.
 
-## Contributions
+### Custody of Contributions
 
-I don't expect contributors to sign up for my personal Gitea in order to send contributions, but it
-of course makes it easier. If you wish to go this route, please sign up at
-<https://git.incorporeal.org/bss/incorporeal-cms> and fork the project. People planning on
-contributing often are also welcome to request access to the project directly.
+I do not request the copyright of contributions be assigned to me or to the project, and I require no
+provision that I be allowed to relicense your contributions. My personal oath is to maintain
+inbound=outbound in my open source projects, and the expectation is authors are responsible for their
+contributions.
 
-Otherwise, contact me via any means you know to reach me at, or <bss@incorporeal.org>, to discuss
-your change and to tell me how to pull your changes.
+I am following the *spirit* of the [Developer Certificate of Origin](https://developercertificate.org/),
+but in a simplified fashion:
 
-### Copyright of Contributions
+By making a contribution to this project, you certify that:
 
-Accepted changes remain the copyright of the original author, but please include appropriate contact
-methods in the event I choose to provide the project under a new license and need to contact you
-to approve the new license terms. Please note that the software is provided under the GNU AGPLv3 (or
-later).
+1. The contribution was created by you and you have the right to submit it under the open source license
+   indicated in the LICENSE file; or
+2. The contribution is based upon previous work that is covered under an appropriate open source license
+   compatible with the license indicated in the LICENSE file, and you have the right to contribute that
+   work with or without modifications, under the terms of that same open source license; or
+3. The contribution was provided directly to you by some other person who certified points 1, 2, or 3, and
+   you have not modified it.
+
+In the event of point 3, your commit **must** include the Signed-off-by line(s) as a chain of custody,
+via `git commit -s`. For points 1 and 2, your commit with accurate Author information doubles as direct
+custody.

incorporealcms/__init__.py

@@ -40,8 +40,9 @@ def create_app(instance_path=None, test_config=None):
         logger.info("RESPONSE: %s %s: %s", request.method, request.path, response.status)
         return response
 
-    from . import error_pages, pages
+    from . import error_pages, pages, static
     app.register_blueprint(pages.bp)
+    app.register_blueprint(static.bp)
     app.register_error_handler(400, error_pages.bad_request)
     app.register_error_handler(404, error_pages.page_not_found)
     app.register_error_handler(500, error_pages.internal_server_error)

incorporealcms/config.py

@@ -32,10 +32,9 @@ class Config(object):
         },
     }
 
-    MARKDOWN_EXTENSIONS = ['extra', 'mdx_linkify', 'sane_lists', 'smarty', 'tables']
+    MARKDOWN_EXTENSIONS = ['extra', 'incorporealcms.mdx.figures', 'sane_lists', 'smarty', 'toc']
     MARKDOWN_EXTENSION_CONFIGS = {
         'extra': {
-            'attr_list': {},
             'footnotes': {
                 'UNIQUE_IDS': True,
             },
@@ -51,6 +50,12 @@ class Config(object):
     MEDIA_DIR = 'media'
 
     # customizations
+    PAGE_STYLES = {
+        'dark': '/static/css/dark.css',
+        'light': '/static/css/light.css',
+        'plain': '/static/css/plain.css',
+    }
+
     DEFAULT_PAGE_STYLE = 'light'
     TITLE_SUFFIX = 'example.com'
     CONTACT_EMAIL = 'admin@example.com'

incorporealcms/lib.py

@@ -31,19 +31,15 @@ def render(template_name_or_list, **context):
 
     * Determine the proper site theme to use in the template and provide it.
     """
-    PAGE_STYLES = {
-        'dark': 'css/dark.css',
-        'light': 'css/light.css',
-        'plain': 'css/plain.css',
-    }
-
+    page_styles = app.config['PAGE_STYLES']
     selected_style = request.args.get('style', None)
     if selected_style:
         user_style = selected_style
     else:
         user_style = request.cookies.get('user-style')
         logger.debug("user style cookie: %s", user_style)
-    context['user_style'] = PAGE_STYLES.get(user_style, PAGE_STYLES.get(app.config['DEFAULT_PAGE_STYLE']))
+    context['user_style'] = page_styles.get(user_style, page_styles.get(app.config['DEFAULT_PAGE_STYLE']))
+    context['page_styles'] = page_styles
 
     resp = make_response(render_template(template_name_or_list, **context))
     if selected_style:

incorporealcms/mdx/figures.py

@@ -0,0 +1,60 @@
+"""Create generic figures with captions."""
+import re
+from xml.etree.ElementTree import SubElement
+
+import markdown
+
+
+class FigureExtension(markdown.Extension):
+    """Wrap the markdown prepcoressor."""
+
+    def extendMarkdown(self, md):
+        """Add FigureBlockProcessor to the Markdown instance."""
+        md.parser.blockprocessors.register(FigureBlockProcessor(md.parser), 'figure', 100)
+
+
+class FigureBlockProcessor(markdown.blockprocessors.BlockProcessor):
+    """Process figures."""
+
+    # |> thing to put in the figure
+    # |: optional caption for the figure
+    # optional whatever else, like maybe an attr_list
+    figure_regex = re.compile(r'^[ ]{0,3}\|>[ ]{0,3}(?P<content>[^\n]*)')
+    caption_regex = re.compile(r'^[ ]{0,3}\|:[ ]{0,3}(?P<caption>[^\n]*)')
+
+    def test(self, parent, block):
+        """Determine if we should process this block."""
+        lines = block.split('\n')
+        return bool(self.figure_regex.search(lines[0]))
+
+    def run(self, parent, blocks):
+        """Replace the top block with HTML."""
+        block = blocks.pop(0)
+        lines = block.split('\n')
+
+        # consume line and create a figure
+        figure_match = self.figure_regex.search(lines[0])
+        lines.pop(0)
+        content = figure_match.group('content')
+        figure = SubElement(parent, 'figure')
+        figure.text = content
+        if lines:
+            if caption_match := self.caption_regex.search(lines[0]):
+                # consume line and add the caption as a child of the figure
+                lines.pop(0)
+                caption = caption_match.group('caption')
+                figcaption = SubElement(figure, 'figcaption')
+                figcaption.text = caption
+        if lines:
+            # other lines are mysteries, might be attr_list, so re-append
+            # make sure there's a child to hang the rest (which is maybe an attr_list?) off of
+            # this is probably a bad hack
+            if not len(list(figure)):
+                SubElement(figure, 'span')
+            rest = '\n'.join(lines)
+            figure[-1].tail = f'\n{rest}'
+
+
+def makeExtension(*args, **kwargs):
+    """Provide the extension to the markdown extension loader."""
+    return FigureExtension(*args, **kwargs)

incorporealcms/mdx/pydot.py

@@ -20,14 +20,17 @@ class InlinePydot(markdown.Extension):
 class InlinePydotPreprocessor(markdown.preprocessors.Preprocessor):
     """Identify dot codeblocks and run them through pydot."""
 
-    BLOCK_RE = re.compile(r'~~~pydot:(?P<filename>[^\s]+)\n(?P<content>.*?)~~~', re.DOTALL)
+    BLOCK_RE = re.compile(r'~~~{\s+pydot:(?P<filename>[^\s]+)\s+}\n(?P<content>.*?)~~~', re.DOTALL)
 
     def run(self, lines):
         """Match and generate diagrams from dot code blocks."""
         text = '\n'.join(lines)
-        for match in self.BLOCK_RE.finditer(text):
-            filename = match.group(1)
-            dot_string = match.group(2)
+        out = text
+        for block_match in self.BLOCK_RE.finditer(text):
+            filename = block_match.group(1)
+            dot_string = block_match.group(2)
+            logger.debug("matched markdown block: %s", dot_string)
+            logger.debug("match start/end: %s/%s", block_match.start(), block_match.end())
 
             # use pydot to turn the text into pydot
             graphs = pydot.graph_from_dot_data(dot_string)
@@ -41,9 +44,9 @@ class InlinePydotPreprocessor(markdown.preprocessors.Preprocessor):
             inline_image = f'![{filename}]({data_path})'
 
             # replace the image in the output markdown
-            text = f'{text[:match.start()]}\n{inline_image}\n{text[match.end():]}'
+            out = out.replace(block_match.group(0), inline_image)
 
-        return text.split('\n')
+        return out.split('\n')
 
 
 def makeExtension(*args, **kwargs):

incorporealcms/pages.py

@@ -7,7 +7,7 @@ import re
 from flask import Blueprint, Markup, abort
 from flask import current_app as app
 from flask import redirect, request, send_from_directory
-from tzlocal import get_localzone
+from werkzeug.security import safe_join
 
 from incorporealcms.lib import get_meta_str, init_md, render
 
@@ -51,7 +51,7 @@ def handle_markdown_file_path(resolved_path):
     try:
         logger.debug("opening resolved path '%s'", resolved_path)
         with app.open_instance_resource(resolved_path, 'r') as entry_file:
-            mtime = datetime.datetime.fromtimestamp(os.path.getmtime(entry_file.name), get_localzone())
+            mtime = datetime.datetime.fromtimestamp(os.path.getmtime(entry_file.name), tz=datetime.timezone.utc)
             entry = entry_file.read()
         logger.debug("resolved path '%s' read", resolved_path)
     except OSError:
@@ -77,6 +77,8 @@ def handle_markdown_file_path(resolved_path):
         page_title = f'{page_name} - {app.config["TITLE_SUFFIX"]}' if page_name else app.config['TITLE_SUFFIX']
         logger.debug("title (potentially derived): %s", page_title)
 
+        extra_footer = get_meta_str(md, 'footer') if md.Meta.get('footer') else None
+
         template = get_meta_str(md, 'template') if md.Meta.get('template') else 'base.html'
 
         # check if this has a HTTP redirect
@@ -87,7 +89,8 @@ def handle_markdown_file_path(resolved_path):
 
         return render(template, title=page_title, description=get_meta_str(md, 'description'),
                       image=get_meta_str(md, 'image'), base_url=request.base_url, content=content,
-                      navs=parent_navs, mtime=mtime.strftime('%Y-%m-%d %H:%M:%S %Z'))
+                      navs=parent_navs, mtime=mtime.strftime('%Y-%m-%d %H:%M:%S %Z'),
+                      extra_footer=extra_footer)
 
 
 def request_path_to_instance_resource_path(path):
@@ -99,15 +102,16 @@ def request_path_to_instance_resource_path(path):
     """
     # check if the path is allowed
     base_dir = os.path.realpath(f'{app.instance_path}/pages/')
-    verbatim_path = os.path.abspath(os.path.join(base_dir, path))
-    resolved_path = os.path.realpath(verbatim_path)
-    logger.debug("base_dir '%s', constructed resolved_path '%s' for path '%s'", base_dir, resolved_path, path)
-
+    safe_path = safe_join(base_dir, path)
     # bail if the requested real path isn't inside the base directory
-    if base_dir != os.path.commonpath((base_dir, resolved_path)):
+    if not safe_path:
         logger.warning("client tried to request a path '%s' outside of the base_dir!", path)
         raise PermissionError
 
+    verbatim_path = os.path.abspath(safe_path)
+    resolved_path = os.path.realpath(verbatim_path)
+    logger.debug("base_dir '%s', constructed resolved_path '%s' for path '%s'", base_dir, resolved_path, path)
+
     # see if we have a real file or if we should infer markdown rendering
     if os.path.exists(resolved_path):
         # if this is a file-like request but actually a directory, redirect the user
@@ -129,7 +133,7 @@ def request_path_to_instance_resource_path(path):
         return resolved_path.replace(f'{app.instance_path}{os.path.sep}', ''), 'file'
 
     # if we're here, this isn't direct file access, so try markdown inference
-    verbatim_path = os.path.abspath(os.path.join(base_dir, f'{path}.md'))
+    verbatim_path = f'{safe_path}.md'
     resolved_path = os.path.realpath(verbatim_path)
 
     # does the final file actually exist?

incorporealcms/static.py

@@ -0,0 +1,14 @@
+"""Serve static files from the instance directory."""
+import os
+
+from flask import Blueprint
+from flask import current_app as app
+from flask import send_from_directory
+
+bp = Blueprint('static', __name__, url_prefix='/custom-static')
+
+
+@bp.route('/<path:name>')
+def serve_instance_static_file(name):
+    """Serve a static file from the instance directory, used for customization."""
+    return send_from_directory(os.path.join(app.instance_path, 'custom-static'), name)

incorporealcms/static/css/base.css

@@ -12,11 +12,11 @@ body {
 }
 
 .site-wrap-normal-width {
-    max-width: 70pc;
+    max-width: 65pc;
 }
 
 .site-wrap-double-width {
-    max-width: 140pc;
+    max-width: 130pc;
 }
 
 .site-wrap {
@@ -26,41 +26,28 @@ body {
     margin-right: auto;
 }
 
-a:link {
+a {
     font-weight: bold;
-    text-decoration: none;
-}
-
-a:visited {
-    font-weight: bold;
-    text-decoration: none;
-}
-
-a:hover {
-    font-weight: bold;
-    text-decoration: none;
-}
-
-a:active {
-    font-weight: bold;
-    text-decoration: none;
+    text-decoration-line: underline;
+    text-decoration-thickness: 1px;
 }
 
 div.header {
     display: flex;
     justify-content: space-between;
-    font-size: 0.75em;
-    padding: 0.25em 0.5em;
-}
-
-div.header a {
-    border-bottom: none;
+    font-size: 0.8em;
+    padding: 1rem 1rem;
+    padding-bottom: 0;
 }
 
 div.content {
     font-size: 11pt;
-    padding: 0 1em;
-    line-height: 1.5em;
+    padding: 0 1rem;
+    line-height: 1.6em;
+}
+
+div.content p {
+    margin: 1.25em 0;
 }
 
 sup, sub {
@@ -79,7 +66,11 @@ footer {
     color: #999;
     padding: 0 1em;
     padding-bottom: 16px;
-    margin-top: 15px;
+    margin-top: 30px;
+}
+
+.extra-footer {
+    margin-bottom: 5px;
 }
 
 table {
@@ -135,39 +126,26 @@ img {
     margin-left: 1em;
 }
 
-.img-frame {
-    padding: 5px;
-}
-
-/* For screens with width smaller than 400px */
-.figure-left .figure-right {
-    max-width: 95%;
-    float: none;
-    margin-left: 10px;
-    margin-right: 10px;
-}
-
-/* For larger screens */
-@media only screen and (min-width: 400px) {
-    .figure-left {
-        float: left;
-        margin-top: 0;
-        margin-left: 0;
-    }
-
-    .figure-right {
-        float: right;
-        margin-top: 0;
-        margin-right: 0;
-    }
-}
-
 figure {
-    max-width: 400px;
     padding: 5px;
-    margin: 10px;
-    margin-top: 0;
+    margin: 0;
     margin-bottom: 5px;
+    text-align: center;
+    max-width: 30%;
+    min-width: 10em;
+    display: inline-block;
+}
+
+figure.right {
+    float: right;
+    margin-left: 10px;
+    display: block;
+}
+
+figure.left {
+    float: left;
+    margin-right: 10px;
+    display: block;
 }
 
 figure img {
@@ -176,19 +154,8 @@ figure img {
 }
 
 figcaption {
-    font-family: "Times New Roman", serif;
-    color: #777777;
     text-align: center;
-    font-style: italic;
-    line-height: 1.3em;
-    margin-top: 5px;
-}
-
-.thumbnail-image {
-    width: 150px;
-    height: auto;
-    margin: 5px;
-    display: inline;
+    font-size: 0.9em;
 }
 
 .footnote {
@@ -200,6 +167,5 @@ figcaption {
 }
 
 .footnote-ref:link, .footnote-ref:visited, .footnote-ref:hover, .footnote-ref:active {
-    border-bottom: none;
     font-weight: normal;
 }

incorporealcms/static/css/dark.css

@@ -6,43 +6,32 @@ html {
 }
 
 body {
-    background: #090909;
-}
-
-strong {
-    color: #EEE;
-}
-
-.site-wrap {
-    background: black;
-
-    border: 1px solid #222;
-    border-top: none;
-    border-bottom: none;
+    background: #111;
 }
 
 h1, h2, h3, h4, h5, h6 {
     color: #B31D15;
 }
 
-a:link, a:visited {
-    color: #EEE;
-    border-bottom: 1px dotted #EEE;
+p a, ul a, ol a {
+    color: #DDD;
 }
 
-a:hover, a:active {
+footer a {
+    color: #999;
+}
+
+p a:hover, ul a:hover, ol a:hover, footer a:hover {
     color: #B31D15;
-    border-bottom: 1px dotted #B31D15;
 }
 
-div.header {
-    background: #222;
-    border-bottom: 1px solid #222;
-    color: #BBB;
+div.site-wrap {
+    background: black;
 }
 
-div.header a {
-    color: #BBB;
+div.header, div.header a {
+    color: #555;
+    text-decoration: none;
 }
 
 table, th, td {
@@ -58,7 +47,11 @@ blockquote {
     border: 1px solid #222;
 }
 
-.img-frame {
+figure {
     background-color: rgba(255, 255, 255, 0.1);
     border: 1px solid #333;
 }
+
+figcaption {
+    color: #AAAAAA;
+}

incorporealcms/static/css/light.css

@@ -6,43 +6,32 @@ html {
 }
 
 body {
-    background: #F6F6F6;
-}
-
-strong {
-    color: #111;
-}
-
-.site-wrap {
-    background: white;
-
-    border: 1px solid #DDD;
-    border-top: none;
-    border-bottom: none;
+    background: #EEE;
 }
 
 h1, h2, h3, h4, h5, h6 {
     color: #811610;
 }
 
-a:link, a:visited {
-    color: #111;
-    border-bottom: 1px dotted #111;
+p a, ul a, ol a {
+    color: #222;
 }
 
-a:hover, a:active {
+footer a {
+    color: #999;
+}
+
+p a:hover, ul a:hover, ol a:hover, footer a:hover {
     color: #811610;
-    border-bottom: 1px dotted #811610;
 }
 
-div.header {
-    background: #DDD;
-    border-bottom: 1px solid #DDD;
-    color: #444;
+div.site-wrap {
+    background: white;
 }
 
-div.header a {
-    color: #444;
+div.header, div.header a {
+    color: #AAA;
+    text-decoration: none;
 }
 
 table, th, td {
@@ -58,7 +47,11 @@ blockquote {
     border: 1px solid #DDD;
 }
 
-.img-frame {
+figure {
     background-color: rgba(0, 0, 0, 0.1);
     border: 1px solid #CCC;
 }
+
+figcaption {
+    color: #666666;
+}

incorporealcms/static/css/plain.css

@@ -1,4 +1,9 @@
-/* specify almost no styling, just fix some image rendering */
+/* specify almost no styling, just fix some image and nav rendering */
+div.header {
+    display: flex;
+    justify-content: space-between;
+}
+
 .img-25 {
     max-width: 25% !important;
 }
@@ -10,3 +15,19 @@
 .img-75 {
     max-width: 75% !important;
 }
+
+.img-center {
+    display: block;
+    margin-left: auto;
+    margin-right: auto;
+}
+
+.img-left {
+    float: left;
+    margin-right: 1em;
+}
+
+.img-right {
+    float: right;
+    margin-left: 1em;
+}

incorporealcms/templates/base.html

@@ -7,7 +7,7 @@
 <meta property="og:url" content="{{ base_url }}">
 <meta name="twitter:card" content="summary_large_image">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<link rel="stylesheet" href="{{ url_for('static', filename=user_style) }}">
+<link rel="stylesheet" href="{{ user_style }}">
 <link rel="icon" href="{% if config.FAVICON %}{{ config.FAVICON }}{% else %}{{ url_for('static', filename='img/favicon.png') }}{% endif %}">
 
 <div {% block site_class %}class="site-wrap site-wrap-normal-width"{% endblock %}>
@@ -20,9 +20,9 @@
             {% endfor %}
         </div>
         <div class="styles">
-            <a href="?style=dark">[dark]</a>
-            <a href="?style=light">[light]</a>
-            <a href="?style=plain">[plain]</a>
+            {% for style in page_styles %}
+            <a href="?style={{ style }}">[{{ style }}]</a>
+            {% endfor %}
         </div>
     </div>
     {% endblock %}
@@ -31,7 +31,8 @@
         {{ content }}
     </div>
     <footer>
-        <i>Last modified: {{ mtime }}</i>
+        {% if extra_footer %}<div class="extra-footer"><i>{{ extra_footer|safe }}</i></div>{% endif %}
+        <div class="footer"><i>Last modified: {{ mtime }}</i></div>
     </footer>
     {% endblock %}
 </div>

requirements/requirements-dev.in

@@ -6,7 +6,7 @@ pytest
 pytest-cov
 
 # linting and other static code analysis
-bandit==1.6.2               # pinned because 1.7.0 wasn't running right in tox
+bandit
 dlint
 flake8
 flake8-blind-except
@@ -21,6 +21,6 @@ safety                      # check requirements file for issues
 
 # maintenance utilities and tox
 pip-tools                   # pip-compile
-tox                         # CI stuff
+tox<4                       # CI stuff, pinned for now to avoid packaging conflict w/safety
 tox-wheel                   # build wheels in tox
 versioneer                  # automatic version numbering

requirements/requirements-dev.txt

@@ -1,37 +1,39 @@
 #
-# This file is autogenerated by pip-compile with python 3.10
-# To update, run:
+# This file is autogenerated by pip-compile with Python 3.10
+# by the following command:
 #
 #    pip-compile --output-file=requirements/requirements-dev.txt requirements/requirements-dev.in
 #
-attrs==21.4.0
+attrs==22.2.0
     # via pytest
-bandit==1.6.2
+bandit==1.7.4
     # via -r requirements/requirements-dev.in
-bleach==4.1.0
-    # via mdx-linkify
-certifi==2021.10.8
+build==0.9.0
+    # via pip-tools
+certifi==2022.12.7
     # via requests
-charset-normalizer==2.0.10
+charset-normalizer==2.1.1
     # via requests
-click==8.0.3
+click==8.1.3
     # via
     #   flask
     #   pip-tools
     #   safety
-coverage[toml]==6.2
+coverage[toml]==7.0.1
     # via pytest-cov
-distlib==0.3.4
+distlib==0.3.6
     # via virtualenv
-dlint==0.12.0
+dlint==0.13.0
     # via -r requirements/requirements-dev.in
-dparse==0.5.1
+dparse==0.6.2
     # via safety
-filelock==3.4.2
+exceptiongroup==1.1.0
+    # via pytest
+filelock==3.9.0
     # via
     #   tox
     #   virtualenv
-flake8==4.0.1
+flake8==5.0.4
     # via
     #   -r requirements/requirements-dev.in
     #   dlint
@@ -40,143 +42,127 @@ flake8==4.0.1
     #   flake8-executable
     #   flake8-isort
     #   flake8-mutable
-flake8-blind-except==0.2.0
+flake8-blind-except==0.2.1
     # via -r requirements/requirements-dev.in
-flake8-builtins==1.5.3
+flake8-builtins==2.1.0
     # via -r requirements/requirements-dev.in
 flake8-docstrings==1.6.0
     # via -r requirements/requirements-dev.in
-flake8-executable==2.1.1
+flake8-executable==2.1.2
     # via -r requirements/requirements-dev.in
 flake8-fixme==1.1.1
     # via -r requirements/requirements-dev.in
-flake8-isort==4.1.1
+flake8-isort==6.0.0
     # via -r requirements/requirements-dev.in
-flake8-logging-format==0.6.0
+flake8-logging-format==0.9.0
     # via -r requirements/requirements-dev.in
 flake8-mutable==1.2.0
     # via -r requirements/requirements-dev.in
-flask==2.0.2
+flask==2.2.2
     # via -r requirements/requirements.in
-gitdb==4.0.9
+gitdb==4.0.10
     # via gitpython
-gitpython==3.1.26
+gitpython==3.1.30
     # via bandit
-idna==3.3
+idna==3.4
     # via requests
 iniconfig==1.1.1
     # via pytest
-isort==5.10.1
+isort==5.11.4
     # via flake8-isort
-itsdangerous==2.0.1
+itsdangerous==2.1.2
     # via flask
-jinja2==3.0.3
+jinja2==3.1.2
     # via flask
-markdown==3.3.6
-    # via
-    #   -r requirements/requirements.in
-    #   mdx-linkify
-markupsafe==2.0.1
-    # via jinja2
-mccabe==0.6.1
-    # via flake8
-mdx-linkify==2.1
+markdown==3.4.1
     # via -r requirements/requirements.in
+markupsafe==2.1.1
+    # via
+    #   jinja2
+    #   werkzeug
+mccabe==0.7.0
+    # via flake8
 packaging==21.3
     # via
-    #   bleach
+    #   build
     #   dparse
     #   pytest
     #   safety
     #   tox
-pbr==5.8.0
+pbr==5.11.0
     # via stevedore
-pep517==0.12.0
-    # via pip-tools
-pip-tools==6.4.0
+pep517==0.13.0
+    # via build
+pip-tools==6.12.1
     # via -r requirements/requirements-dev.in
-platformdirs==2.4.1
+platformdirs==2.6.2
     # via virtualenv
 pluggy==1.0.0
     # via
     #   pytest
     #   tox
 py==1.11.0
-    # via
-    #   pytest
-    #   tox
-pycodestyle==2.8.0
+    # via tox
+pycodestyle==2.9.1
     # via flake8
 pydocstyle==6.1.1
     # via flake8-docstrings
 pydot==1.4.2
     # via -r requirements/requirements-dev.in
-pyflakes==2.4.0
+pyflakes==2.5.0
     # via flake8
-pyparsing==3.0.6
+pyparsing==3.0.9
     # via
     #   packaging
     #   pydot
-pytest==6.2.5
+pytest==7.2.0
     # via
     #   -r requirements/requirements-dev.in
     #   pytest-cov
-pytest-cov==3.0.0
+pytest-cov==4.0.0
     # via -r requirements/requirements-dev.in
-pytz-deprecation-shim==0.1.0.post0
-    # via tzlocal
 pyyaml==6.0
-    # via
-    #   bandit
-    #   dparse
-requests==2.27.1
+    # via bandit
+requests==2.28.1
     # via safety
-safety==1.10.3
+ruamel-yaml==0.17.21
+    # via safety
+ruamel-yaml-clib==0.2.7
+    # via ruamel-yaml
+safety==2.3.5
     # via -r requirements/requirements-dev.in
 six==1.16.0
-    # via
-    #   bandit
-    #   bleach
-    #   tox
-    #   virtualenv
+    # via tox
 smmap==5.0.0
     # via gitdb
 snowballstemmer==2.2.0
     # via pydocstyle
-stevedore==3.5.0
+stevedore==4.1.1
     # via bandit
-testfixtures==6.18.3
-    # via flake8-isort
 toml==0.10.2
+    # via dparse
+tomli==2.0.1
     # via
-    #   dparse
-    #   pytest
-    #   tox
-tomli==2.0.0
-    # via
+    #   build
     #   coverage
     #   pep517
-tox==3.24.5
+    #   pytest
+    #   tox
+tox==3.28.0
     # via
     #   -r requirements/requirements-dev.in
     #   tox-wheel
-tox-wheel==0.7.0
+tox-wheel==1.0.0
     # via -r requirements/requirements-dev.in
-tzdata==2021.5
-    # via pytz-deprecation-shim
-tzlocal==4.1
-    # via -r requirements/requirements.in
-urllib3==1.26.8
+urllib3==1.26.13
     # via requests
-versioneer==0.21
+versioneer==0.28
     # via -r requirements/requirements-dev.in
-virtualenv==20.13.0
+virtualenv==20.17.1
     # via tox
-webencodings==0.5.1
-    # via bleach
-werkzeug==2.0.2
+werkzeug==2.2.2
     # via flask
-wheel==0.37.1
+wheel==0.38.4
     # via
     #   pip-tools
     #   tox-wheel

requirements/requirements.in

@@ -1,4 +1,2 @@
 Flask                       # general purpose web service and web server stuff
 Markdown                    # markdown rendering in templates
-mdx-linkify                 # convert URLs in the text to clickable links
-tzlocal                     # identifying system's local timezone

requirements/requirements.txt

@@ -4,37 +4,19 @@
 #
 #    pip-compile --output-file=requirements/requirements.txt requirements/requirements.in
 #
-bleach==4.1.0
-    # via mdx-linkify
-click==8.0.3
+click==8.1.3
     # via flask
-flask==2.0.2
+flask==2.2.2
     # via -r requirements/requirements.in
-itsdangerous==2.0.1
+itsdangerous==2.1.2
     # via flask
-jinja2==3.0.3
+jinja2==3.1.2
     # via flask
-markdown==3.3.6
+markdown==3.4.1
+    # via -r requirements/requirements.in
+markupsafe==2.1.1
     # via
-    #   -r requirements/requirements.in
-    #   mdx-linkify
-markupsafe==2.0.1
-    # via jinja2
-mdx-linkify==2.1
-    # via -r requirements/requirements.in
-packaging==21.3
-    # via bleach
-pyparsing==3.0.6
-    # via packaging
-pytz-deprecation-shim==0.1.0.post0
-    # via tzlocal
-six==1.16.0
-    # via bleach
-tzdata==2021.5
-    # via pytz-deprecation-shim
-tzlocal==4.1
-    # via -r requirements/requirements.in
-webencodings==0.5.1
-    # via bleach
-werkzeug==2.0.2
+    #   jinja2
+    #   werkzeug
+werkzeug==2.2.2
     # via flask

tests/functional_markdown_tests.py

@@ -29,6 +29,17 @@ def test_graphviz_is_rendered():
     assert b'data:image/png;base64' in response.data
 
 
+def test_two_graphviz_are_rendered():
+    """Test two images are rendered."""
+    app = app_with_pydot()
+    client = app.test_client()
+
+    response = client.get('/test-two-graphviz')
+    assert response.status_code == 200
+    assert b'~~~pydot' not in response.data
+    assert b'data:image/png;base64' in response.data
+
+
 def test_invalid_graphviz_is_not_rendered():
     """Check that invalid graphviz doesn't blow things up."""
     app = app_with_pydot()
@@ -37,3 +48,16 @@ def test_invalid_graphviz_is_not_rendered():
     response = client.get('/test-invalid-graphviz')
     assert response.status_code == 500
     assert b'INTERNAL SERVER ERROR' in response.data
+
+
+def test_figures_are_rendered(client):
+    """Test that a page with my figure syntax renders as expected."""
+    response = client.get('/figures')
+    assert response.status_code == 200
+    assert (b'<figure class="right"><img alt="fancy captioned logo" src="bss-square-no-bg.png" />'
+            b'<figcaption>this is my cool logo!</figcaption></figure>') in response.data
+    assert (b'<figure><img alt="vanilla captioned logo" src="bss-square-no-bg.png" />'
+            b'<figcaption>this is my cool logo without an attr!</figcaption>\n</figure>') in response.data
+    assert (b'<figure class="left"><img alt="fancy logo" src="bss-square-no-bg.png" />'
+            b'<span></span></figure>') in response.data
+    assert b'<figure><img alt="just a logo" src="bss-square-no-bg.png" /></figure>' in response.data

tests/functional_tests.py

@@ -7,7 +7,7 @@ def test_page_that_exists(client):
     """Test that the app can serve a basic file at the index."""
     response = client.get('/')
     assert response.status_code == 200
-    assert b'<h1>test index</h1>' in response.data
+    assert b'<h1 id="test-index">test index</h1>' in response.data
 
 
 def test_direct_file_that_exists(client):
@@ -134,32 +134,32 @@ def test_that_page_request_redirects_to_directory(client):
     """
     response = client.get('/subdir')
     assert response.status_code == 301
-    assert response.location == 'http://localhost/subdir/'
+    assert response.location == '/subdir/'
 
 
 def test_that_request_to_symlink_redirects_markdown(client):
     """Test that a request to /foo redirects to /what-foo-points-at."""
     response = client.get('/symlink-to-no-title')
     assert response.status_code == 301
-    assert response.location == 'http://localhost/no-title'
+    assert response.location == '/no-title'
 
 
 def test_that_request_to_symlink_redirects_file(client):
     """Test that a request to /foo.txt redirects to /what-foo-points-at.txt."""
     response = client.get('/symlink-to-foo.txt')
     assert response.status_code == 301
-    assert response.location == 'http://localhost/foo.txt'
+    assert response.location == '/foo.txt'
 
 
 def test_that_request_to_symlink_redirects_directory(client):
     """Test that a request to /foo/ redirects to /what-foo-points-at/."""
     response = client.get('/symlink-to-subdir/')
     assert response.status_code == 301
-    assert response.location == 'http://localhost/subdir'
+    assert response.location == '/subdir'
     # sadly, this location also redirects
     response = client.get('/subdir')
     assert response.status_code == 301
-    assert response.location == 'http://localhost/subdir/'
+    assert response.location == '/subdir/'
     # but we do get there
     response = client.get('/subdir/')
     assert response.status_code == 200
@@ -169,7 +169,7 @@ def test_that_request_to_symlink_redirects_subdirectory(client):
     """Test that a request to /foo/bar redirects to /what-foo-points-at/bar."""
     response = client.get('/symlink-to-subdir/page-no-title')
     assert response.status_code == 301
-    assert response.location == 'http://localhost/subdir/page-no-title'
+    assert response.location == '/subdir/page-no-title'
     response = client.get('/subdir/page-no-title')
     assert response.status_code == 200
 
@@ -190,15 +190,15 @@ def test_setting_selected_style_includes_cookie(client):
     response = client.get('/?style=light')
     style_cookie = next((cookie for cookie in client.cookie_jar if cookie.name == 'user-style'), None)
     assert response.status_code == 200
-    assert b'light.css' in response.data
-    assert b'dark.css' not in response.data
+    assert b'/static/css/light.css' in response.data
+    assert b'/static/css/dark.css' not in response.data
     assert style_cookie.value == 'light'
 
     response = client.get('/?style=dark')
     style_cookie = next((cookie for cookie in client.cookie_jar if cookie.name == 'user-style'), None)
     assert response.status_code == 200
-    assert b'dark.css' in response.data
-    assert b'light.css' not in response.data
+    assert b'/static/css/dark.css' in response.data
+    assert b'/static/css/light.css' not in response.data
     assert style_cookie.value == 'dark'
 
 
@@ -210,3 +210,31 @@ def test_pages_can_supply_alternate_templates(client):
     response = client.get('/custom-template')
     assert b'class="site-wrap site-wrap-normal-width"' not in response.data
     assert b'class="site-wrap site-wrap-double-width"' in response.data
+
+
+def test_extra_footer_per_page(client):
+    """Test that we don't include the extra-footer if there isn't one (or do if there is)."""
+    response = client.get('/')
+    assert b'<div class="extra-footer">' not in response.data
+    response = client.get('/index-but-with-footer')
+    assert b'<div class="extra-footer"><i>ooo <a href="a">a</a></i>' in response.data
+
+
+def test_serving_static_files(client):
+    """Test the usage of send_from_directory to serve extra static files."""
+    response = client.get('/custom-static/css/warm.css')
+    assert response.status_code == 200
+
+    # can't serve directories, just files
+    response = client.get('/custom-static/')
+    assert response.status_code == 404
+    response = client.get('/custom-static/css/')
+    assert response.status_code == 404
+    response = client.get('/custom-static/css')
+    assert response.status_code == 404
+
+    # can't serve files that don't exist or bad paths
+    response = client.get('/custom-static/css/cold.css')
+    assert response.status_code == 404
+    response = client.get('/custom-static/css/../../unreachable.md')
+    assert response.status_code == 404

tests/instance/config.py

@@ -15,6 +15,10 @@ LOGGING = {
         },
     },
     'loggers': {
+        'incorporealcms.mdx': {
+            'level': 'DEBUG',
+            'handlers': ['console'],
+        },
         'incorporealcms.pages': {
             'level': 'DEBUG',
             'handlers': ['console'],

tests/instance/custom-static/css/warm.css

@@ -0,0 +1,3 @@
+* {
+    color: red;
+}

tests/instance/pages/figures.md

@@ -0,0 +1,13 @@
+# test of figures
+
+|> ![fancy captioned logo](bss-square-no-bg.png)
+|: this is my cool logo!
+{: .right }
+
+|> ![vanilla captioned logo](bss-square-no-bg.png)
+|: this is my cool logo without an attr!
+
+|> ![fancy logo](bss-square-no-bg.png)
+{: .left }
+
+|> ![just a logo](bss-square-no-bg.png)

tests/instance/pages/index-but-with-footer.md

@@ -0,0 +1,6 @@
+Title:      Index
+Footer:     ooo <a href="a">a</a>
+
+# test index
+
+this is some test content

tests/instance/pages/test-graphviz.md

@@ -1,7 +1,7 @@
 # test
 
 test
-~~~pydot:attack-plan
+~~~{ pydot:attack-plan }
 digraph G {
     rankdir=LR
     Earth

tests/instance/pages/test-invalid-graphviz.md

@@ -1,7 +1,7 @@
 # test
 
 test
-~~~pydot:attack-plan
+~~~{ pydot:attack-plan }
     rankdir=LR
     Earth
     Mars

tests/instance/pages/test-two-graphviz.md

@@ -0,0 +1,25 @@
+# test
+
+test
+
+~~~{ pydot:attack-plan }
+digraph G {
+    rankdir=LR
+    Earth
+    Mars
+    Earth -> Mars
+}
+~~~
+
+more test
+
+~~~{ pydot:new-attack-plan }
+digraph H {
+    rankdir=LR
+    Venus
+    Mars
+    Venus -> Mars
+}
+~~~
+
+done

tests/test_pages.py

@@ -1,10 +1,15 @@
 """Unit test helper methods."""
+import os
+
 import pytest
 from werkzeug.http import dump_cookie
 
+from incorporealcms import create_app
 from incorporealcms.pages import (generate_parent_navs, instance_resource_path_to_request_path, render,
                                   request_path_to_breadcrumb_display, request_path_to_instance_resource_path)
 
+HERE = os.path.dirname(os.path.abspath(__file__))
+
 
 def test_generate_page_navs_index(app):
     """Test that the index page has navs to the root (itself)."""
@@ -49,22 +54,74 @@ def test_render_with_user_dark_theme(app):
     """Test that a request with the dark theme selected renders the dark theme."""
     cookie = dump_cookie("user-style", 'dark')
     with app.test_request_context(headers={'COOKIE': cookie}):
-        assert b'dark.css' in render('base.html').data
-        assert b'light.css' not in render('base.html').data
+        assert b'/static/css/dark.css' in render('base.html').data
+        assert b'/static/css/light.css' not in render('base.html').data
 
 
 def test_render_with_user_light_theme(app):
     """Test that a request with the light theme selected renders the light theme."""
     with app.test_request_context():
-        assert b'light.css' in render('base.html').data
-        assert b'dark.css' not in render('base.html').data
+        assert b'/static/css/light.css' in render('base.html').data
+        assert b'/static/css/dark.css' not in render('base.html').data
 
 
 def test_render_with_no_user_theme(app):
     """Test that a request with no theme set renders the light theme."""
     with app.test_request_context():
-        assert b'light.css' in render('base.html').data
-        assert b'dark.css' not in render('base.html').data
+        assert b'/static/css/light.css' in render('base.html').data
+        assert b'/static/css/dark.css' not in render('base.html').data
+
+
+def test_render_with_theme_defaults_affects_html(app):
+    """Test that the base themes are all that's presented in the HTML."""
+    # test we can remove stuff from the default
+    with app.test_request_context():
+        assert b'?style=light' in render('base.html').data
+        assert b'?style=dark' in render('base.html').data
+        assert b'?style=plain' in render('base.html').data
+
+
+def test_render_with_theme_overrides_affects_html(app):
+    """Test that the overridden themes are presented in the HTML."""
+    # test we can remove stuff from the default
+    restyled_app = create_app(instance_path=os.path.join(HERE, 'instance'),
+                              test_config={'PAGE_STYLES': {'light': '/static/css/light.css'}})
+    with restyled_app.test_request_context():
+        assert b'?style=light' in render('base.html').data
+        assert b'?style=dark' not in render('base.html').data
+        assert b'?style=plain' not in render('base.html').data
+
+    # test that we can add new stuff too/instead
+    restyled_app = create_app(instance_path=os.path.join(HERE, 'instance'),
+                              test_config={'PAGE_STYLES': {'cool': '/static/css/cool.css',
+                                                           'warm': '/static/css/warm.css'},
+                                           'DEFAULT_PAGE_STYLE': 'warm'})
+    with restyled_app.test_request_context():
+        assert b'?style=cool' in render('base.html').data
+        assert b'?style=warm' in render('base.html').data
+
+
+def test_render_with_theme_overrides(app):
+    """Test that the loaded themes can be overridden from the default."""
+    cookie = dump_cookie("user-style", 'cool')
+    restyled_app = create_app(instance_path=os.path.join(HERE, 'instance'),
+                              test_config={'PAGE_STYLES': {'cool': '/static/css/cool.css',
+                                                           'warm': '/static/css/warm.css'}})
+    with restyled_app.test_request_context(headers={'COOKIE': cookie}):
+        assert b'/static/css/cool.css' in render('base.html').data
+        assert b'/static/css/warm.css' not in render('base.html').data
+
+
+def test_render_with_theme_overrides_not_found_is_default(app):
+    """Test that theme overrides work, and if a requested theme doesn't exist, the default is loaded."""
+    cookie = dump_cookie("user-style", 'nonexistent')
+    restyled_app = create_app(instance_path=os.path.join(HERE, 'instance'),
+                              test_config={'PAGE_STYLES': {'cool': '/static/css/cool.css',
+                                                           'warm': '/static/css/warm.css'},
+                                           'DEFAULT_PAGE_STYLE': 'warm'})
+    with restyled_app.test_request_context(headers={'COOKIE': cookie}):
+        assert b'/static/css/warm.css' in render('base.html').data
+        assert b'/static/css/nonexistent.css' not in render('base.html').data
 
 
 def test_request_path_to_instance_resource_path(app):

tox.ini

@@ -56,9 +56,10 @@ commands =
 # run security checks
 #
 # again it seems the most valuable here to run against the packaged code
+# 51457 is nearly a red herring that I'm stuck with because tox is pinned, try removing occasionally
 commands =
     bandit {envsitepackagesdir}/incorporealcms/ -r
-    safety check -r requirements/requirements-dev.txt
+    safety check -r requirements/requirements-dev.txt -i 51457
 
 [testenv:lint]
 # run style checks