External markup renderer [$15] #117

@plemp commented on GitHub (Dec 11, 2016):

The default can be empty, then it's not a dependency and more like plugin interface.

@plemp commented on GitHub (Dec 11, 2016): The default can be empty, then it's not a dependency and more like plugin interface.

GiteaMirror commented

@lunny commented on GitHub (Dec 11, 2016):

We could find a go lib to do that

@lunny commented on GitHub (Dec 11, 2016): We could find a go lib to do that

GiteaMirror commented

@lunny commented on GitHub (Dec 12, 2016):

It seems there isn't any mature Golang library to do that. So maybe give a config like @plemp said, but default is closed currently.

@lunny commented on GitHub (Dec 12, 2016): It seems there isn't any mature Golang library to do that. So maybe give a config like @plemp said, but default is closed currently.

GiteaMirror commented

@bkcsoft commented on GitHub (Dec 12, 2016):

IMO adding external renderers isn't a bad idea, could be made with a simple list.
Have a simple schema to identify arguments, basically injecting .InFile and .OutFile

Example:

EXTERNAL_RENDER = .rst:/usr/bin/rst2html5 {{ .InFile }} > {{ .OutFile }}

given

renderParam := struct {
  InFile  string
  OutFile string
}{"foo.rst", "/tmp/gitea-1337/foo.html"}

would generate /usr/bin/rst2html5 foo.rst > /tmp/gitea-1337/foo.html

@bkcsoft commented on GitHub (Dec 12, 2016): IMO adding external renderers isn't a bad idea, could be made with a simple list. Have a simple schema to identify arguments, basically injecting `.InFile` and `.OutFile` Example: ``` EXTERNAL_RENDER = .rst:/usr/bin/rst2html5 {{ .InFile }} > {{ .OutFile }} ``` given ``` renderParam := struct { InFile string OutFile string }{"foo.rst", "/tmp/gitea-1337/foo.html"} ``` would generate `/usr/bin/rst2html5 foo.rst > /tmp/gitea-1337/foo.html`

GiteaMirror commented

@tboerger commented on GitHub (Dec 16, 2016):

I would prefer to integrate a real plugin system instead of increasing the current config more and more

@tboerger commented on GitHub (Dec 16, 2016): I would prefer to integrate a real plugin system instead of increasing the current config more and more

GiteaMirror commented

@Solido commented on GitHub (Mar 11, 2017):

Well I guess I'm just here to vote for .asciidoc the rich format and feature is offers have make it a defacto tools in our product chain.

@Solido commented on GitHub (Mar 11, 2017): Well I guess I'm just here to vote for **.asciidoc** the rich format and feature is offers have make it a defacto tools in our product chain.

GiteaMirror commented

@joneepenk commented on GitHub (Mar 16, 2017):

@tboerger maybe external renderer is better choice, because asciidoc is an extensible format. the renderer itself should have a plugin system.

@joneepenk commented on GitHub (Mar 16, 2017): @tboerger maybe external renderer is better choice, because asciidoc is an extensible format. the renderer itself should have a plugin system.

GiteaMirror commented

https://github.com/AlphaGriffin/gogs

@lannocc commented on GitHub (May 26, 2017):

I recently did a quick-and-dirty hack on Gogs to add some basic .rst support for our own use, but maybe you will also find it useful:

@lannocc commented on GitHub (May 26, 2017): I recently did a quick-and-dirty hack on Gogs to add some basic .rst support for our own use, but maybe you will also find it useful: https://github.com/AlphaGriffin/gogs

GiteaMirror commented

@lunny commented on GitHub (May 26, 2017):

@lannocc great! I will try to merge it on v1.3

@lunny commented on GitHub (May 26, 2017): @lannocc great! I will try to merge it on v1.3

GiteaMirror commented

@lunny commented on GitHub (Sep 17, 2017):

After #2525 merged, I will try to add reStructuredText support based on github.com/hhatto/gorst and https://github.com/AlphaGriffin/gogs. And I think that should be easy since that a new document type only implementation markup.Parser.

@lunny commented on GitHub (Sep 17, 2017): After #2525 merged, I will try to add reStructuredText support based on github.com/hhatto/gorst and https://github.com/AlphaGriffin/gogs. And I think that should be easy since that a new document type only implementation `markup.Parser`.

GiteaMirror commented

@lunny commented on GitHub (Sep 17, 2017):

~~And for asciidoc, since github.com/VonC/asciidocgo could be imported.~~

@lunny commented on GitHub (Sep 17, 2017): ~And for asciidoc, since github.com/VonC/asciidocgo could be imported.~

GiteaMirror commented

@lunny commented on GitHub (Sep 21, 2017):

@plemp, It seems there is no golang lib to handle asciidoc well. don't know how to use github.com/VonC/asciidocgo.

@lunny commented on GitHub (Sep 21, 2017): @plemp, It seems there is no golang lib to handle asciidoc well. don't know how to use `github.com/VonC/asciidocgo`.

GiteaMirror commented

@lenisko commented on GitHub (Oct 20, 2017):

Any update on this one?
@lunny https://godoc.org/github.com/VonC/asciidocgo documentation looks good to me

@lenisko commented on GitHub (Oct 20, 2017): Any update on this one? @lunny https://godoc.org/github.com/VonC/asciidocgo documentation looks good to me

GiteaMirror commented

@lunny commented on GitHub (Oct 20, 2017):

@lenisko #2570 will support external render commands.

@lunny commented on GitHub (Oct 20, 2017): @lenisko #2570 will support external render commands.

GiteaMirror commented

@tantegerda1 commented on GitHub (Nov 15, 2017):

@lunny: Bountysource keeps telling me "Your application has been suspended" and throws various {"error":"Internal server error."} responses, keeping me from releasing the bounty. The mails I got from them uniquely say that if I "don't respond" you will get the bounty paid out at 2017-11-21. Sorry for that delay!
Could you check back at that date and - please - get in touch with me[1], should Bountysource fail to pay the bounty.
Thank you - and all contributors - for your continuous work on Gitea!

[1] via GitHub or accounts+github@netztechniker.at

@tantegerda1 commented on GitHub (Nov 15, 2017): @lunny: Bountysource keeps telling me "Your application has been suspended" and throws various `{"error":"Internal server error."}` responses, keeping me from releasing the bounty. The mails I got from them uniquely say that if I "don't respond" you will get the bounty paid out at 2017-11-21. Sorry for that delay! Could you check back at that date and - please - get in touch with me[1], should Bountysource fail to pay the bounty. Thank you - and all contributors - for your continuous work on Gitea! --- [1] via GitHub or `accounts+github@netztechniker.at`

GiteaMirror commented

@lunny commented on GitHub (Nov 15, 2017):

@tantegerda1 OK. Thanks for your bounty.

@lunny commented on GitHub (Nov 15, 2017): @tantegerda1 OK. Thanks for your bounty.

GiteaMirror commented

@James-E-A commented on GitHub (Sep 21, 2018):

Getting this working was as simple as

Installing docutils (didn't even need root for that!)
Ensuring PATH contains $HOME/.local/bin
Appending a small snippet to app.ini:

[markup.restructuredtext]
ENABLED = true
FILE_EXTENSIONS = .rst
RENDER_COMMAND = rst2html.py
IS_INPUT_FILE = false

Restart the server 👍…and DONE! Readme.rst renders just as prettily on my selfhost as on GitHub! 🎉

However, what I am wondering is: isn't this a security nightmare*? How quick+easy would it be for some sufficiently clever person to monkey into existence a Readme.rst that, when uploaded, would allow doing things not otherwise doable on the server?

*—in a situation involving potentially untrusted users having write access to repositories

@James-E-A commented on GitHub (Sep 21, 2018): Getting this working was as simple as 1. Installing `docutils` (didn't even need root for that!) 2. Ensuring `PATH` contains `$HOME/.local/bin` 3. Appending a small snippet to `app.ini`: ```` [markup.restructuredtext] ENABLED = true FILE_EXTENSIONS = .rst RENDER_COMMAND = rst2html.py IS_INPUT_FILE = false ```` 4. Restart the server 👍…and DONE! `Readme.rst` renders just as prettily on my selfhost as on GitHub! 🎉 However, what I am wondering is: isn't this a security *nightmare*\*? How quick+easy would it be for some sufficiently clever person to monkey into existence a `Readme.rst` that, when uploaded, would allow _doing things not otherwise doable_ on the server? *\*—in a situation involving potentially untrusted users having write access to repositories*

GiteaMirror commented

@James-E-A commented on GitHub (Sep 21, 2018):

Although, a small P.S. to the previous comment:

Installing…

Ensuring…

Adding a small snippet…

Restart…!

Is the above explicitly documented anywhere beyond thread #2570 in GitHub's walled-garden forum, associated with (but not documented in) commit 62d0a4d882 ?

@James-E-A commented on GitHub (Sep 21, 2018): Although, a small P.S. to the previous comment: >1. Installing… >2. Ensuring… >3. Adding a small snippet… >4. Restart…! Is the above explicitly documented _anywhere_ beyond thread #2570 in GitHub's walled-garden forum, associated with (but not documented in) commit 62d0a4d8829f214af4f9c00ecf8a81907d86ef06 ?

GiteaMirror commented