nextcloud / cms_pico

🗃 Integrate Pico CMS and let your users manage their own websites

Pico CMS for Nextcloud

About

Pico CMS for Nextcloud combines the power of Pico and Nextcloud to create simple, secure, shareable and amazingly powerful websites with just a few clicks. Pico is a stupidly simple, blazing fast, flat file CMS - making the web easy!

• 📓 Start a blog
• 🚀 Share your resume with the world
• 😈 Create a plan for world domination and only share with the right friends
• Build a knowledge base and let the smart ones among your colleagues help out

Installing Pico CMS for Nextcloud allows your users to create and manage their own websites. Creating a new page with Pico is no more than creating a simple text file in a users' Nextcloud files. No config is required, no utterly complex management interfaces - just files. It's the perfect match with Nextcloud. Secure Sharing, Collaboration, Access Control - not just for your files, but also your websites, all made possible by Pico CMS for Nextcloud! Breaking the boundaries between your Mobile & Desktop devices and your Server.

Websites will be accessible through URLs like https://cloud.example.com/sites/my_site/ and consist of just a bunch of .md text files in a user's Nextcloud files. .md stands for Markdown - a super simple and intuitive markup to create headings, paragraphs, text formatting, lists, images and links. But don't despair - you don't have to learn yet another language if you don't want to. Consider enabling Nextcloud's Markdown Editor app to make easy things stupidly simple. Please note that Nextcloud's built-in Text editor is incompatible with Pico CMS for Nextcloud. But what about meta data like a page's title or release date? Guess right, it's all in one place. At the top of your Markdown files you can place a block with such meta data - called the YAML Front Matter. Creating websites can't be easier…

But that wasn't everything… Pico CMS for Nextcloud is highly customizable. You can change Pico’s appearance by using custom themes and add new functionality by using custom plugins. For security reasons users can neither add custom themes nor plugins on their own - but as an admin you can. Plugins and themes aren’t just new "skins" or "widgets", the underlying technologies are powerful frameworks you can leverage to make your users' websites truly unique. However, with great power comes great responsibility. Pico CMS for Nextcloud does its best to prevent users from including scripts into websites, since this might bear security risks (so called "Cross Scripting"). Since this risk doesn't apply to Pico itself, 3rd-party developers of plugins and themes might not be aware of this issue - so be careful when installing custom plugins and themes.

You want to learn more about Pico CMS for Nextcloud? Easy! Just download and enable the app from Nextcloud's App Store and navigate to Nextcloud's settings page. As an admin you'll find two "Pico CMS" sections in your Nextcloud settings - one below "Personal", another below "Administration". The latter allows you to add custom themes, plugins and templates to Pico, as well as tweaking some advanced settings. The "Pico CMS" section below "Personal" exists for all Nextcloud users and allows one to create personal websites. Simply create your first personal website and choose "sample_pico" as website template. Pico's sample contents will explain all you need to know… 👋

Installation

App Store

Pico CMS for Nextcloud can be found in Nextcloud's App Store. Installing the app using the app store is super easy: Simply navigate to the Apps management page of your Nextcloud and either search for "Pico CMS" or check the "Tools" section to find Pico CMS for Nextcloud. Hit the "Download and enable" button and you're ready to go!

Manually

1. Open a shell and navigate to Nextcloud's install directory (e.g. /var/www/html/nextcloud). Clone Pico CMS for Nextcloud's Git repository to your apps/cms_pico/ directory:

   $ git clone https://github.com/nextcloud/cms_pico.git apps/cms_pico
   

2. Run composer install to install the app's dependencies. If you haven't installed Composer yet, you must download it first.

   $ cd apps/cms_pico/
   $ curl -sSL https://getcomposer.org/installer | php
   $ php composer.phar install
   

3. Make sure that your webserver has write permissions on the app's appdata_public/ directory. You can ensure this by matching the permissions (owner, group and permissions) of Nextcloud's data/ directory:

   $ chown --reference=../../data/ appdata_public
   $ chmod --reference=../../data/ appdata_public
   

Known limitations

HTML in Markdown files

One of Markdown's key features is that users can use arbitrary HTML in their Markdown files to enable more advanced contents. However, since all websites of Pico CMS for Nextcloud run under the same domain as Nextcloud, this bears a huge security risk: Users with some knowledge could attack other users of your Nextcloud, including you, the Nextcloud admin (so called "Cross Scripting"). Pico CMS for Nextcloud follows a "Better safe than sorry" mentality, thus we let HTMLPurifier remove any potentially active content from Markdown files.

For this reason you cannot use HTML features like <iframe>, <audio>, <video> and <script> in your Markdown files - on purpose! These limitations don't apply to themes, so if you know what you're doing, you can create a custom theme to include any advanced features you need (for example a video player). However, please be careful not to introduce security risks!

Nextcloud's Text App

Nextcloud's official Text app is incompatible with Pico CMS for Nextcloud, as is destroys otherwise valid Markdown files (it e.g. removes YAML Front Matters). Unfortunately we cannot do anything about this, it's a rather complex issue in the realm of the Text app. Please see #116 for more info.

In the meantime we recommend using Nextcloud's Markdown editor app or the Plain text editor app. Please note that Nextcloud's Text app will still interfere with your Nextcloud install (also see App behaviors), thus we recommend you to disable the Text app altogether.

App incompatibilities

Due to how Nextcloud and most other PHP applications handle dependencies, there's a huge potential of dependency conflicts. Due to this some Nextcloud apps have known incompatibilities with Pico CMS for Nextcloud. This is no-one's fault, neither are Nextcloud nor the conflicting apps to blame, this is just some technical limitation of Nextcloud's app infrastructure we cannot solve in the short term. Please see #97 for more info.

In the meantime you must remove all conflicting apps. Known conflicting apps are Issue Template and Terms of service. If you see the error "Call to undefined method ParsedownExtra::textElements()" in Nextcloud's log even though you've removed all conflicting apps, please don't hesitate to open a new Issue on GitHub with a copy of the error including its stack trace and a complete list of all apps installed.

Getting help

Something went wrong? You need help? No worries, we will help!

If you want to get started using Pico, please refer to Pico's user docs. You can find officially supported plugins and themes on Pico's website. A greater choice of third-party plugins and themes can be found in Pico's wiki on the plugins or themes pages respectively. If you want to create your own plugin or theme, please refer to the “Getting Help as a developer” section of Pico's docs.

When the docs cannot answer your question, you can get help by either joining us on #picocms on Libera.Chat (logs), or by creating a new thread on Nextcloud Help. When you’re experiencing problems with Pico CMS for Nextcloud, please don’t hesitate to create a new Issue on GitHub. Concerning problems with Pico, open a new Issue on Pico's GitHub repository. If you have problems with plugins or themes, please refer to the website of the developer of this plugin or theme.

Before creating a new Issue, please make sure the problem wasn’t reported yet using GitHubs search engine on both the nextcloud/cms_pico and picocms/Pico repos, as well as the search of Nextcloud Help. Please describe your issue as clear as possible and always include the exact error message (if any) as well as all related messages in Nextcloud's logs. Also include the exact Nextcloud version and the version of Pico CMS for Nextcloud you’re using. Provided that you’re using custom plugins and/or themes, include a list of them too. We need information about the actual and expected behavior , the steps to reproduce the problem, and what steps you have taken to resolve the problem by yourself (i.e. your own troubleshooting).

cms_pico's Issues

Links should use rewritten base URL

When setting up a rewritten base URL like /sites/ the generated menu should also make use of it instead of linking to /index.php/apps/cms_pico/pico/...

HTML tags <details> and <summary> are removed / don't work

Hi,

I would like to create an FAQ with all the questions and when you click them, the answer in form of a text block will expand below this question. Before HTML5 this was usually achieved by Java script.

Now trying out Pico CMS I would like to go without any Java script and use only HTML5 instead.
The following works on a "normal" web page:

<details>
<summary>Short text</summary>
<p>Long, hidden text, that unfolds if visitor clicks on the summary text</p>
</details>

But using this in cms_pico these tags (details and summary) are removed on the web site and consequently there is no hidden text that unfolds/ expands.

Could these tags please be kept and not filtered out?

Thanks a lot.

Serverinfo:
Nextcloud 12.3
cms_pico 0.9.6
nginx 1.12
PHP 7.1

Custom themes are lost when updating the app

The title is self-explanatory. I had a custom theme in apps/cms_pico/Pico/themes (that I have backuped), then it disappeared when I used the web updater to upgrade cms_pico to 0.9.6.
I could restore it, but it is pretty annoying if I need to do it at every new update. Also, the other admin users of my nextcloud installation do not know how to restore a theme, and may update the app

Only let the administrator create websites

Sorry i can't create a pull requests but if we could have an option so that only the administrator could create websites; not all the users

Thanks,

0.95 duplication of folder in personal settings link.

Just updated to version 0.95 and now the link in the personal settings page has an issue. I am using the mod rewrite.

When I click on the link to the newly created page "newsite" it redirects to:
...index.php/apps/cms_pico/pico/newsite/newsite
Instead of
...index.php/apps/cms_pico/pico/newsite/
or
...index.php/apps/cms_pico/pico/newsite/index
like it should

Layout should not use tables

For that reason all elements get highlighted on hover (even the paragraphs).

cc @nextcloud/designers

Allow links to .md files

I am not sure if this is a PicoCMS limitation or a cms_pico limitation but I would like to have links to markdown files directly. Right now to link to a page you need to do this: [some page](%base_url%?somepage) and what I would rather have is [some page](somepage.md) or even [some page](somepage)

Apache configuration difficulty

hello to all

I'm having a difficulty to understand the configuration of apache to cms pico to work.

In https://github.com/nextcloud/cms_pico/wiki/Admin-Settings#customizing, it is indicated what should be copied to the configuration of Apache, but it does not say how to do it.

What is the config file in cause?
is /etc/apache2/apache2.config or something else.
I'm skeptical to touch in these files because it may damage may nextcloud instance

Caddyserver rewrite rules

Hi, I have some problem to make a working rewrite rule for the caddy server. Has anyone a working rewrite rule for this HTTP-Server?

My problem is that, that the picoCMS url redirect to the nextcloud file app.
Here an example:
https://example.com/sites/thinktank => https://example.com/index.php/apps/files/

Here my current nextcloud CaddyFile

example {
  log syslog
  errors syslog

  gzip {
    level 6
  }

  header / Strict-Transport-Security "max-age=31536000;"

  root /var/www/example

# picoCMS
  rewrite /sites/ {
    to /index.php/apps/cms_pico/pico/{path}&{query}
  }

# normale commands
  rewrite {
    r ^/index.php/.*$
    to /index.php?{query}
  }

  # client support (e.g. os x calendar / contacts)
  redir /.well-known/carddav /remote.php/carddav 301
  redir /.well-known/caldav /remote.php/caldav 301

  # remove trailing / as it causes errors with php-fpm
  rewrite {
    r ^/remote.php/(webdav|caldav|carddav|dav)(\/?)$
    to /remote.php/{1}
  }

  # .htaccess / data / config / ... shouldn't be accessible from outside
  status 403 {
    /.htacces
    /data
    /config
    /db_structure
    /.xml
    /README
  }

#####################################################
# PHP
   fastcgi / 127.0.0.1:9000 php {
     env Path /bin
   }

}

Spaces and links

Hi. The markdown specification says that a link destination should not contain spaces, but sometimes my .md files do contain spaces.

It would be great if underscores in a link target could match a space in a markdown file name. For instance if I have a link [some text](hello_world), it would match hello_world.md if it exists (exact match first), then hello world.md if it exists (underscore space matching).

What do you think?

Different rendering in markdown preview and browser

As a nextcloud beginner I'm not sure if this is my own handling error...
Some markups are correctly displayed in markdown preview, but not in browser's window and vice versa. I've marked two distinctive examples in the screenshots: a picture from /assets folder (red) and a prezi video-link (yellow).

Getting broken sites due to CSP

I installed the Dimension theme featured on the Pico CMS website into apps/cms_pico/Pico/themes, I enabled the theme and set the demo website found in the Dimension github repository as my website content.

When going to the index at https://<mydomain>/index.php/apps/cms_pico/pico/<sitename>/index, the site is quite broken because it can't load jQuery. I can see the following message in the console.

Refused to load the script 'https://<mydomain>/apps/cms_pico/Pico/themes/dimension/assets/js/jquery.min.js' because it violates the following Content Security Policy directive: "script-src 'nonce-<big-ass string>' 'unsafe-eval'".

How should I go about fixing this?

Nginx configuration

Hello,
You present the configuration for apache. But what should we do for nginx?
Thank you

Default theme is vulnerable to XSS

While the body is now properly sanitized using HtmlPurifier, the default theme is still vulnerable to XSS for example in the title as shown in below PoC.

Probably we need to adjust https://github.com/nextcloud/cms_pico/blob/ecb34dbf7368d01480abd193cdd3766c9ae801d3/Pico/themes/default/index.twig to use https://twig.symfony.com/doc/2.x/filters/escape.html on all values except {{ content }} (which is sanitized by HtmlPurifier)

---
Title: Welcome"><h1>a<script>alert(1)</script>
---

## Welcome to Pico

Content is properly sanitized as [we see](javascript:alert(1)). <script>alert(1);</script><h1>TEst</h1>

<!DOCTYPE html>
<html lang="en" class="no-js">
<head>
    <meta charset="utf-8" />

    <title>Welcome"><h1>a<script>alert(1)</script> | mytest1</title>
    
    <link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Open+Sans:400,700" type="text/css" />
    <link rel="stylesheet" href="/apps/cms_pico/Pico/themes/default/style.css" type="text/css" />
    <link rel="stylesheet" href="/apps/cms_pico/Pico/themes/default/fontello.css" type="text/css" />

    <script src="/apps/cms_pico/Pico/themes/default/scripts/modernizr-2.6.1.min.js"></script>
</head>
<body>

    <header id="header">
        <div class="inner clearfix">
            <h1><a href="/stable9mytest1/?index" id="logo">mytest1</a></h1>
            <nav>
                <ul>
                                            <li class="active">
                            <a href="/stable9mytest1/?index">Welcome"><h1>a<script>alert(1)</script></a>
                        </li>
                                            <li>
                            <a href="/stable9mytest1/?sub%2Findex">Sub Page Index</a>
                        </li>
                                            <li>
                            <a href="/stable9mytest1/?sub%2Fpage">Sub Page</a>
                        </li>
                                    </ul>
            </nav>
        </div>
    </header>

    <section id="content">
        <div class="inner">
            <h2>Welcome to Pico</h2>
<p>COntent is properly sanitized as <a>we see</a>. </p><h1>TEst</h1>
        </div>
    </section>

    <footer id="footer">
        <div class="inner">
            <div class="social">
                            </div>
            <a href="http://picocms.org/">Pico</a> was made by <a href="http://gilbert.pellegrom.me">Gilbert Pellegrom</a>
            and is maintained by <a href="https://github.com/picocms/Pico/graphs/contributors">The Pico Community</a>.
            Released under the <a href="https://github.com/picocms/Pico/blob/master/LICENSE.md">MIT license</a>.
        </div>
    </footer>

</body>
</html>

Check that Pico/plugins/Nextcloud.php exists

Before rendering the Pico page, verify that the plugin is available.

Default theme not loading, issue with directory when Nextcloud not in web-root

Seems like there is some issue loading the theme files when nextcloud is not in the web-root.

My nextcloud setup is like the following:
www.mysite.com/nextcloud/ (www.mysite.com runs another web-site)

This plugin with mod_rewrite (on a share host, only .htaccess and thus no mod_proxy I think) shows pico user websites under
www.mysite.com/sites/picouserwebsite
(as explained in the docs, at first I was a bit confused that it isn't www.mysite.com/nextcloud/sites/picouserwebsite but now I actually like it that way)

However it just renders the plain html as converted from the markdown files (including pictures from the assets folder).

When I check the web-console it tells me that it fails to load:
modernizr-2.6.1.min.js, style.css & fontello.css
as it looks for them under:
www.mysite.com/apps/cms_pico/Pico/themes/default/
www.mysite.com/apps/cms_pico/Pico/themes/default/scripts/

and not
www.mysite.com/nextcloud/apps/cms_pico/Pico/themes/default/
like it should.

error messages

copy(/var/webserv/meinecloud/apps/cms_pico/cms_pico/vendor/twig/twig/test/bootstrap.php): failed to open stream: No such file or directory at /var/webserv/meinecloud/lib/private/legacy/helper.php#191	2017-10-05T10:24:13+0200
Error	PHP
Error	PHP
Error	PHP
Error	PHP
Error	PHP

Oo????

Audio

Hi !

How can I can include audio files (and the associated audio player) to a pico page using the markdown syntax ?

Now, I generate a public link with my files and use it in my markdown page but the user is obliged to access the download page with this link, download the file and read it with a local player. It could be far more simpler to read an audio file directly with the brower's player but I don't find how to do it (markdown syntax or/and nextcloud access).

Thanks!

Cannot display site when pages stored on an external mount local storage

Hi,

I was trying to use Cms Pico App with nextcloud 12. Since i have encryption enabled i had added an un-encrypyed external mount point for local storage. I can edit the .md file on the external storage and can see it is not encrpted.

Problem I found:

1. An error is displayed that encryption is enabled which is not true for the external local storage location. The check for encrption need to be specific to the mount point if possible. I guess it is very common to have encryption for user files activated.
2. I commented out the encryption check but then get another error on the page "Webpage cannot be rendered"

I wouldlike to debug/trace but dont know a good way to output the content of the exception that is thrown in the code

Possibly wrong themePath displayed

Commit 2a6113b7 updated templates/settings.admin.php, displaying the actual directory where the user should place new themes, rather than just saying 'apps/cms_pico/Pico/themes/'. Displaying the directory where themes should be placed is done with $_['pathToThemes'].

This is a good change and potentially very helpful to the user. However, in my case $_['pathToThemes'] displays as /var/ncdata/appdata_ocmnpoor4wsx/cms_pico/themes/, i.e. the APPDATA directory, not the INSTALL directory. Themes in the $APPDATA/cms_pico/themes directory are indeed detected by the admin panel JS, but, at least to me, they don't work when "installed" through the admin panel. I need them to be in the install directory, which in my case is /var/www/nextcloud/apps/cms_pico/Pico/themes/, before the themes work. Otherwise the various css and js files aren't found.

I assume one of the following is the issue:

1. There is something wrong with my nextcloud/pico setup, or
2. The wrong directory is displayed with $_['pathToThemes'] (i.e. it should show the install directory, not the appdata directory), or
3. The installation of the themes in APPDATA goes wrong and the themes are not properly installed.
4. There is a bug somewhere which means that themes in $APPDATA/cms_pico/themes aren't found, only the files in $INSTALL/apps/cms_pico/Pico/themes.

I have manually resolved my issue by making symlinks in /var/www/nextcloud/apps/cms_pico/Pico/themes/ (the INSTALL directory) which points to the themes in /var/ncdata/appdata_ocmnpoor4wsx/cms_pico/themes/ (the APPDATA directory).

Demo code of PicoCMS should be removed

/apps/cms_pico/vendor/picocms/pico/index.php:

Invalid twig template leads to full path disclosure

When adding {% include '/etc/passwd' %} to a Twig template the following error message is displayed to the user:

"Unable to find template "/etc/passwd" (looked into: /tmp/asdsadsads/admin/files/my_site1/themes/default) in "index.twig" at line 5."

ParseError Message: syntax error, unexpected '?'

I'm struggling to get this awesome looking app to work (Nextcloud 13, Ubuntu 16.04). I've installed as per instructions (as far as I can understand them - the apache stuff is a bit light), and set up a demo page called welcome. Calling https://mycloud/sites/welcome/?sub/welcome and https://mycloud/sites/welcome both return Internal Server Error. The error log reports:

{
  "reqId": "9HBvrcZtg5BmSKzXyovD",
  "level": 3,
  "time": "2018-04-19T17:03:58+01:00",
  "remoteAddr": "x.x.x.x",
  "user": "myuser",
  "app": "index",
  "method": "GET",
  "url": "\/index.php\/apps\/cms_pico\/pico\/welcome",
  "message": "Exception: {\"Exception\":\"ParseError\",\"Message\":\"syntax error, unexpected '?'\",\"Code\":0,\"Trace\":\"#0 \\\/var\\\/www\\\/nextcloud\\\/lib\\\/composer\\\/composer\\\/ClassLoader.php(321): Composer\\\\Autoload\\\\includeFile('\\\/var\\\/www\\\/nextcl...')\\n#1 [internal function]: Composer\\\\Autoload\\\\ClassLoader->loadClass('Symfony\\\\\\\\Compone...')\\n#2 \\\/var\\\/www\\\/nextcloud\\\/apps\\\/cms_pico\\\/vendor\\\/picocms\\\/pico\\\/lib\\\/Pico.php(785): spl_autoload_call('Symfony\\\\\\\\Compone...')\\n#3 \\\/var\\\/www\\\/nextcloud\\\/apps\\\/cms_pico\\\/lib\\\/Pico.php(81): Pico->parseFileMeta('---\\\\nTitle: Welc...', Array)\\n#4 \\\/var\\\/www\\\/nextcloud\\\/apps\\\/cms_pico\\\/vendor\\\/picocms\\\/pico\\\/lib\\\/Pico.php(321): OCA\\\\CMSPico\\\\Pico->parseFileMeta('---\\\\nTitle: Welc...', Array)\\n#5 \\\/var\\\/www\\\/nextcloud\\\/apps\\\/cms_pico\\\/lib\\\/Service\\\/PicoService.php(166): Pico->run()\\n#6 \\\/var\\\/www\\\/nextcloud\\\/apps\\\/cms_pico\\\/lib\\\/Service\\\/PicoService.php(109): OCA\\\\CMSPico\\\\Service\\\\PicoService->getContentFromPico(Object(OCA\\\\CMSPico\\\\Model\\\\Website))\\n#7 \\\/var\\\/www\\\/nextcloud\\\/apps\\\/cms_pico\\\/lib\\\/Service\\\/WebsitesService.php(249): OCA\\\\CMSPico\\\\Service\\\\PicoService->getContent(Object(OCA\\\\CMSPico\\\\Model\\\\Website))\\n#8 \\\/var\\\/www\\\/nextcloud\\\/apps\\\/cms_pico\\\/lib\\\/Controller\\\/PicoController.php(103): OCA\\\\CMSPico\\\\Service\\\\WebsitesService->getWebpageFromSite('welcome', 'myuser', '')\\n#9 \\\/var\\\/www\\\/nextcloud\\\/apps\\\/cms_pico\\\/lib\\\/Controller\\\/PicoController.php(88): OCA\\\\CMSPico\\\\Controller\\\\PicoController->getPage('welcome', '')\\n#10 [internal function]: OCA\\\\CMSPico\\\\Controller\\\\PicoController->getRoot('welcome')\\n#11 \\\/var\\\/www\\\/nextcloud\\\/lib\\\/private\\\/AppFramework\\\/Http\\\/Dispatcher.php(161): call_user_func_array(Array, Array)\\n#12 \\\/var\\\/www\\\/nextcloud\\\/lib\\\/private\\\/AppFramework\\\/Http\\\/Dispatcher.php(91): OC\\\\AppFramework\\\\Http\\\\Dispatcher->executeController(Object(OCA\\\\CMSPico\\\\Controller\\\\PicoController), 'getRoot')\\n#13 \\\/var\\\/www\\\/nextcloud\\\/lib\\\/private\\\/AppFramework\\\/App.php(115): OC\\\\AppFramework\\\\Http\\\\Dispatcher->dispatch(Object(OCA\\\\CMSPico\\\\Controller\\\\PicoController), 'getRoot')\\n#14 \\\/var\\\/www\\\/nextcloud\\\/lib\\\/private\\\/AppFramework\\\/Routing\\\/RouteActionHandler.php(47): OC\\\\AppFramework\\\\App::main('OCA\\\\\\\\CMSPico\\\\\\\\Con...', 'getRoot', Object(OC\\\\AppFramework\\\\DependencyInjection\\\\DIContainer), Array)\\n#15 [internal function]: OC\\\\AppFramework\\\\Routing\\\\RouteActionHandler->__invoke(Array)\\n#16 \\\/var\\\/www\\\/nextcloud\\\/lib\\\/private\\\/Route\\\/Router.php(297): call_user_func(Object(OC\\\\AppFramework\\\\Routing\\\\RouteActionHandler), Array)\\n#17 \\\/var\\\/www\\\/nextcloud\\\/lib\\\/base.php(998): OC\\\\Route\\\\Router->match('\\\/apps\\\/cms_pico\\\/...')\\n#18 \\\/var\\\/www\\\/nextcloud\\\/index.php(37): OC::handleRequest()\\n#19 {main}\",\"File\":\"\\\/var\\\/www\\\/nextcloud\\\/apps\\\/news\\\/vendor\\\/symfony\\\/yaml\\\/Parser.php\",\"Line\":510}",
  "userAgent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/65.0.3325.181 Safari\/537.36",
  "version": "13.0.1.1"
}

From what I can tell the critical bit is ParseError Message: syntax error, unexpected '?', and this relates to line 510 of /var/www/nextcloud/apps/news/vendor/symfony/yaml/Parser.php. That line is:

    510     private function getNextEmbedBlock(int $indentation = null, bool $inSequence = false): ?string
    511     {
    512         $oldLineIndentation = $this->getCurrentLineIndentation();
    ...

Possibly the issue related to the ?string at the end of that line?

I've been wondering if this is related to the version of PHP we're running. I've been trying to upgrade to 7.2, so my /var/apache2/ contains:

lrwxrwxrwx 1 root root   29 Apr  6 08:03 php7.0.conf -> ../mods-available/php7.0.conf
lrwxrwxrwx 1 root root   29 Apr  6 08:03 php7.0.load -> ../mods-available/php7.0.load
lrwxrwxrwx 1 root root   29 Apr 19 14:56 php7.2.conf -> ../mods-available/php7.2.conf
lrwxrwxrwx 1 root root   29 Apr 19 14:56 php7.2.load -> ../mods-available/php7.2.load

However, when I run a2dismod php7.0 and a2enmod php7.2 Nextcloud completely breaks with HTTP ERROR 500.

Very grateful for assistance.

Admin and personal settings should be registered using info.xml

cms_pico/lib/AppInfo/Application.php

Lines 56 to 62 in 528b651

	public function registerSettingsAdmin() {
	\OCP\App::registerAdmin(self::APP_NAME, 'lib/admin');
	}
	public function registerSettingsPersonal() {
	\OCP\App::registerPersonal(self::APP_NAME, 'lib/personal');
	}

should be replaced with an approach such as

https://github.com/nextcloud/user_saml/blob/610efe21451dad8b6dbe0f39e78132140dad463c/appinfo/info.xml#L38-L41

Compat NC11 - error application activation

Hello,

I am on nextcloud 11.0.5.1, if i change in appinfo the file info.xml the section:
dependencies
nextcloud min-version="11" max-version="13"
dependencies
I have a error when i try to activate this application:
Erreur lors de l'activation de l'application - error application activation

How can i resolv this error, please ?

In my nextcloud log i see this error line:
"PHP","message":"Interface 'OCP\Settings\IIconSection' not found at /var/www/nextcloud/apps/cms_pico/lib/Settings/AdminSection.php#34"

I have found this:
https://fossies.org/diffs/nextcloud/11.0.3_vs_12.0.0/settings/Controller/AdminSettingsController.php-diff.html

iiconSection not exist in 11.0.5.1...

Local links don't work as expected

I've been creating my notes in .md files, and I want them to be accessible from the outside world.
I've been using MDwiki, and it works perfectly, but I'd like to give CMS pico a try, because my home server might not be accessible form the outside on port 80 anymore.

Nevertheless, I run into an issue when using local links from the index.md to another files. If I use [detailed page](detailed_page) construction (which should work fine, because the file is in the same directory), the link fails, because it is trying to open ../sites/detailed_page, which obviously doesn't exist. I have to update the links to [detailed page](notes/detailed_page), which is very inconsistent.

Why is that? Is there a way to fix it?

P.S.
I also think that the correct construction should be [detailed page](detailed_page.md), so that it corresponds with the actual filename (as it should).

Could this be fixed?
.

picocms's Twig content filter extension

I've been trying to use the content filter that is registered as a simple twig extension in pico with no luck. Trying to include content from other pages (e.g. below) in a template produces nothing.

{% for page in pages %}
	{{ page.id|content }}<br/><br/>
{% endfor %}

I haven't tried it with a standalone instance of pico, but it appears to be a working filter according to other posts (picocms/Pico#403) on the picocms github repo.

{"name":"myCloud","error":"Die Adresse der Website darf nur alphanumerische Zeichen enthalten"}

{"name":"myCloud","error":"Die Adresse der Website darf nur alphanumerische Zeichen enthalten"}

I've got an alphnumberic Letter in my Nextcloud Web-Address ..so this message means,that PICO is not able to create the Web-Site because of that.

Can this be corrected, because i think .. it's common used, that WEB-Sites does contain alpha-numeric letters.

Thx a lot
Mike

Include additional templates (for a wiki etc.)?

Would be cool if there was a more wiki like template that makes it easy for users to quickly make a wiki.
At best if this plugin was also included:
https://github.com/arckauss/Pico-Categorized-Pages

And maybe:
https://github.com/mwgg/Pico-Search

App is not compliant according to "occ"

I couldn't get Picocms plugin running on my site, so I started to investigate a bit, and found out that the "occ"-command does not think this app is compliant.

Is this a bug, or is it a user error when enabling the app?

Nextcloud info / cms_pico:

PHP 7.0.10 (cli) (built: Nov  3 2016 08:06:03) ( NTS )```
```# sudo -u apache /opt/rh/rh-php70/root/bin/php /var/www/html/nextcloud/occ status
  - installed: true
  - version: 12.0.3.3
  - versionstring: 12.0.3

- cms_pico: 0.9.6

Analysing /var/www/html/nextcloud/apps/cms_pico/lib/Pico.php
 1 errors
    line  134: OC_App - Static method of private class must not be called
App is not compliant

RFE: Restrict site by network

This could be done in Apache config, I guess, but anyway ...

Some sites I have only make sense on the same network as the Nextcloud server (eg an internal wiki). I don't need it to be "private" (that is, anyone should be able to look a it), but only from, say, 192.168.1.0/24.

Creating a site on encryption-enabled cloud doesn't work

When creating a page on master of the app and Nextcloud and then accessing it at https://10.211.55.7/stable9/index.php/apps/cms_pico/pico/my_site all I get is:

"Invalid content directory "/tmp/oc_tmp_xOamFW/content-sample/""

Markdown parser of PicoCMS allows XSS

Markdown:

Congratulations, you have successfully installed [Pico](javascript:alert(1)).

Rendered HTML:

<p>Congratulations, you have successfully installed <a href="javascript:alert(1)">Pico</a>.

Internal Server Error with nextcloud 13

Steps to reproduce

1. Install nextcloud 13 and pico_cms app.
2. Turn on mod_rewrite in nextcloud server configuration

RewriteEngine On
RewriteRule /sites/(.*) https://server/nextcloud/index.php/apps/cms_pico/pico/$1 [QSA,L]

3. Create a website in pico and try to access it.

Expected behaviour

Site should open without any error.

Actual behaviour

Internal server error while accessing a site.

Server configuration detail

Operating system: Linux 4.9.59-v7+ #1047 SMP Sun Oct 29 12:19:23 GMT 2017 armv7l

Webserver: Apache/2.4.25 (Raspbian) (apache2handler)

Database: mysql 10.1.23

PHP version: 7.0.27-0+deb9u1
Modules loaded: Core, date, libxml, openssl, pcre, zlib, filter, hash, Reflection, SPL, session, standard, apache2handler, mysqlnd, PDO, xml, apcu, apc, calendar, ctype, curl, dom, mbstring, fileinfo, ftp, gd, gettext, iconv, imagick, intl, json, exif, mcrypt, mysqli, pdo_mysql, Phar, posix, readline, shmop, SimpleXML, sockets, sysvmsg, sysvsem, sysvshm, tokenizer, wddx, xmlreader, xmlwriter, xsl, zip, Zend OPcache

Nextcloud version: 13.0.0 - 13.0.0.14

Updated from an older Nextcloud/ownCloud or fresh install: fresh install

Where did you install Nextcloud from: using tar file from nextcloud.com

Signing status

Array

List of activated apps

Enabled:
 - activity: 2.6.1
 - admin_notifications: 1.0.1
 - apporder: 0.4.1
 - bookmarks: 0.10.1
 - bruteforcesettings: 1.0.3
 - calendar: 1.6.0
 - checksum: 0.3.5
 - cms_pico: 0.9.7
 - comments: 1.3.0
 - contacts: 2.0.1
 - dashboard: 4.0.5
 - dav: 1.4.6
 - deck: 0.3.0
 - federatedfilesharing: 1.3.1
 - federation: 1.3.0
 - files: 1.8.0
 - files_accesscontrol: 1.3.0
 - files_automatedtagging: 1.3.0
 - files_downloadactivity: 1.2.0
 - files_markdown: 2.0.1
 - files_pdfviewer: 1.2.0
 - files_sharing: 1.5.0
 - files_texteditor: 2.5.1
 - files_trashbin: 1.3.0
 - files_versions: 1.6.0
 - files_videoplayer: 1.2.0
 - firstrunwizard: 2.2.1
 - gallery: 18.0.0
 - issuetemplate: 0.3.0
 - limit_login_to_ip: 1.0.2
 - logreader: 2.0.0
 - lookup_server_connector: 1.1.0
 - mail: 0.7.9
 - metadata: 0.6.0
 - news: 12.0.1
 - nextcloud_announcements: 1.2.0
 - notes: 2.3.2
 - notifications: 2.1.2
 - oauth2: 1.1.0
 - orcid: 0.9.1
 - password_policy: 1.3.0
 - provisioning_api: 1.3.0
 - ransomware_protection: 1.1.0
 - serverinfo: 1.3.0
 - sharebymail: 1.3.0
 - survey_client: 1.1.0
 - systemtags: 1.3.0
 - tasks: 0.9.6
 - theming: 1.4.1
 - twofactor_backupcodes: 1.2.3
 - unsplash: 1.0.5
 - updatenotification: 1.3.0
 - workflowengine: 1.3.0
Disabled:
 - admin_audit
 - encryption
 - files_external
 - user_external
 - user_ldap

Configuration (config/config.php)

{
    "instanceid": "***REMOVED SENSITIVE VALUE***",
    "passwordsalt": "***REMOVED SENSITIVE VALUE***",
    "secret": "***REMOVED SENSITIVE VALUE***",
    "trusted_domains": [
        "10.103.15.200",
        "server"
    ],
    "datadirectory": "***REMOVED SENSITIVE VALUE***",
    "overwrite.cli.url": "http:\/\/10.103.15.200\/nextcloud",
    "dbtype": "mysql",
    "version": "13.0.0.14",
    "dbname": "***REMOVED SENSITIVE VALUE***",
    "dbhost": "***REMOVED SENSITIVE VALUE***",
    "dbport": "",
    "dbtableprefix": "oc_",
    "mysql.utf8mb4": true,
    "dbuser": "***REMOVED SENSITIVE VALUE***",
    "dbpassword": "***REMOVED SENSITIVE VALUE***",
    "memcache.local": "\\OC\\Memcache\\APCu",
    "proxy": "http:\/\/172.16.2.30:8080",
    "installed": true,
    "loglevel": 0
}

Are you using external storage, if yes which one: local

Are you using encryption: no

Are you using an external user-backend, if yes which one: No

Client configuration

Browser: Mozilla/5.0 (X11; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0

Operating system: Debian Testing

Logs

Nextcloud log

{"reqId":"7QDKAPhcPsC18SQygqWI","level":3,"time":"2018-02-11T02:45:09+00:00","remoteAddr":"10.103.15.150","user":"user","app":"index","method":"GET","url":"\/nextcloud\/index.php\/apps\/cms_pico\/pico\/dddd","message":"Exception: {\"Exception\":\"ParseError\",\"Message\":\"syntax error, unexpected '?'\",\"Code\":0,\"Trace\":\"#0 \\\/data\\\/web_data\\\/nextcloud\\\/lib\\\/composer\\\/composer\\\/ClassLoader.php(321): Composer\\\\Autoload\\\\includeFile('\\\/data\\\/web_data\\\/...')\\n#1 [internal function]: Composer\\\\Autoload\\\\ClassLoader->loadClass('Symfony\\\\\\\\Compone...')\\n#2 \\\/data\\\/web_data\\\/nextcloud\\\/apps\\\/cms_pico\\\/vendor\\\/picocms\\\/pico\\\/lib\\\/Pico.php(785): spl_autoload_call('Symfony\\\\\\\\Compone...')\\n#3 \\\/data\\\/web_data\\\/nextcloud\\\/apps\\\/cms_pico\\\/lib\\\/Pico.php(81): Pico->parseFileMeta('---\\\\nTitle: Sub ...', Array)\\n#4 \\\/data\\\/web_data\\\/nextcloud\\\/apps\\\/cms_pico\\\/vendor\\\/picocms\\\/pico\\\/lib\\\/Pico.php(994): OCA\\\\CMSPico\\\\Pico->parseFileMeta('---\\\\nTitle: Sub ...', Array)\\n#5 \\\/data\\\/web_data\\\/nextcloud\\\/apps\\\/cms_pico\\\/vendor\\\/picocms\\\/pico\\\/lib\\\/Pico.php(340): Pico->readPages()\\n#6 \\\/data\\\/web_data\\\/nextcloud\\\/apps\\\/cms_pico\\\/lib\\\/Service\\\/PicoService.php(166): Pico->run()\\n#7 \\\/data\\\/web_data\\\/nextcloud\\\/apps\\\/cms_pico\\\/lib\\\/Service\\\/PicoService.php(109): OCA\\\\CMSPico\\\\Service\\\\PicoService->getContentFromPico(Object(OCA\\\\CMSPico\\\\Model\\\\Website))\\n#8 \\\/data\\\/web_data\\\/nextcloud\\\/apps\\\/cms_pico\\\/lib\\\/Service\\\/WebsitesService.php(249): OCA\\\\CMSPico\\\\Service\\\\PicoService->getContent(Object(OCA\\\\CMSPico\\\\Model\\\\Website))\\n#9 \\\/data\\\/web_data\\\/nextcloud\\\/apps\\\/cms_pico\\\/lib\\\/Controller\\\/PicoController.php(103): OCA\\\\CMSPico\\\\Service\\\\WebsitesService->getWebpageFromSite('dddd', 'user', '')\\n#10 \\\/data\\\/web_data\\\/nextcloud\\\/apps\\\/cms_pico\\\/lib\\\/Controller\\\/PicoController.php(88): OCA\\\\CMSPico\\\\Controller\\\\PicoController->getPage('dddd', '')\\n#11 [internal function]: OCA\\\\CMSPico\\\\Controller\\\\PicoController->getRoot('dddd')\\n#12 \\\/data\\\/web_data\\\/nextcloud\\\/lib\\\/private\\\/AppFramework\\\/Http\\\/Dispatcher.php(161): call_user_func_array(Array, Array)\\n#13 \\\/data\\\/web_data\\\/nextcloud\\\/lib\\\/private\\\/AppFramework\\\/Http\\\/Dispatcher.php(91): OC\\\\AppFramework\\\\Http\\\\Dispatcher->executeController(Object(OCA\\\\CMSPico\\\\Controller\\\\PicoController), 'getRoot')\\n#14 \\\/data\\\/web_data\\\/nextcloud\\\/lib\\\/private\\\/AppFramework\\\/App.php(115): OC\\\\AppFramework\\\\Http\\\\Dispatcher->dispatch(Object(OCA\\\\CMSPico\\\\Controller\\\\PicoController), 'getRoot')\\n#15 \\\/data\\\/web_data\\\/nextcloud\\\/lib\\\/private\\\/AppFramework\\\/Routing\\\/RouteActionHandler.php(47): OC\\\\AppFramework\\\\App::main('OCA\\\\\\\\CMSPico\\\\\\\\Con...', 'getRoot', Object(OC\\\\AppFramework\\\\DependencyInjection\\\\DIContainer), Array)\\n#16 [internal function]: OC\\\\AppFramework\\\\Routing\\\\RouteActionHandler->__invoke(Array)\\n#17 \\\/data\\\/web_data\\\/nextcloud\\\/lib\\\/private\\\/Route\\\/Router.php(297): call_user_func(Object(OC\\\\AppFramework\\\\Routing\\\\RouteActionHandler), Array)\\n#18 \\\/data\\\/web_data\\\/nextcloud\\\/lib\\\/base.php(998): OC\\\\Route\\\\Router->match('\\\/apps\\\/cms_pico\\\/...')\\n#19 \\\/data\\\/web_data\\\/nextcloud\\\/index.php(37): OC::handleRequest()\\n#20 {main}\",\"File\":\"\\\/data\\\/web_data\\\/nextcloud\\\/apps\\\/news\\\/vendor\\\/symfony\\\/yaml\\\/Parser.php\",\"Line\":510}","userAgent":"Mozilla\/5.0 (X11; Linux x86_64; rv:58.0) Gecko\/20100101 Firefox\/58.0","version":"13.0.0.14"}

request: filesystem abstraction & persistent federated data

there are currently no plans to add filesystem abstraction to Pico, as it kinda objects the "stupidly simple" approach regarding Pico's own code. Thus it's unlikely that this will be implemented on Pico's side. However, another solution is to let Nextcloud cache external storages locally, allowing Pico to access the files locally. That's what persistent federated data basically is about. Thus it's tracked in this issue. However, this is nothing we can carry out ourselves.

See server issue #8459 on allowing federated data to be optionally stored across multiple Nextcloud instances in order to avoid a single point of failure! This would benefit apps such as PicoCMS hosting live websites and files to the public.

Arbitrary code execution due to "config/config.php"

If someone uploads a malicious config/config.php it is executed as the web server user. For example the following content:

<?php
echo("Hacked");
exit();

is it somehow possible to use <iframes> ?

I tried to use iFrames an failed.
First I got error massages on my webbrowser Console regarding CSP.
To fix it I ajusted my CSP, until no errors were shown in the Browser Console.
I tried very simple Sites in my iFrame e.g. GoogleMaps.

What am I doing wrong or is it disabled/impossible ?

Link to local directory is wrongly generated

Shows a 404 page on the base link due to url duplication (using .htaccess file only)

Just updated to version 0.95 and now there is an issue with the redirection. I am using the mod rewrite.

When I go to
https://myurl.com/sites/newsite/
it gives me the pico cms 404 page because it redirects to:
...index.php/apps/cms_pico/pico/newsite/newsite

Probably the same cause as this:
#22

PHP Fatal error: Class 'Pico' not found in /var/www/nextcloud/apps/cms_pico/lib/Pico.php on line 32

After app installation, composer install and extending the apache configuration, Pico sites only display a blank, white page.

The apache error log mentions this single line:
PHP Fatal error: Class 'Pico' not found in /var/www/nextcloud/apps/cms_pico/lib/Pico.php on line 32

RFE: Custom config.php per Pico site

Many of the custom themes available for Pico require you to add things to config.php for them to display properly. It's be great to be able to put a custom config.php in the Nextcloud directory to enable using such themes.

Example: https://github.com/xupefei/Travelify#installation

Apache Configuration is not Well Documented

"Copy one of the example below and paste the line in your Apache configuration " is the line in the Pico CMS settings area, but it does not specify where to paste this line. When I attempted to do so Apache would not start any longer and I had to revert the change.

A clearer example should be given.

Web site public (not private) don't work - we must be authenticated on nextcloud

in the personal menu if I leave untouched private in my current websites, the site is not accessible publicly only after authentication with my server nextcloud.

When i make a copy of the default template to my own all the css/javascript is not accepted, why?

Dear all,

I want to make my own template copied from the default template.
When i copy the 'default' template directory to my own version say 'MyOwn' i can select this new template in NextCloud. But when i assign it to a site all external files in the template will not be rendered.
No css files, no javascript files etc.
In the codeviewer of the webbrowser i can see the URL's to the files but when i access them i get the loginscreen of Nextcloud.

Why ??

I'm running nextcloud 13.

Thanks in advance,

Klaas Eenkhoorn.

making cms_pico sites available in "root folders" (own domains )

There doesn't seem to be an option (nor documented manual config currently) that supports to make a cms_pico site in nextcloud available as the "root folder" of a domain.

Either

1. In the root of the main nextcloud domain (and the Nextcloud interface only being available in a subfolder, like for example /login ).
2. Under separate domains used to access specific cms_pico sites.

Until there is a configuration option, it would be good to document a manual solution at:
https://github.com/nextcloud/cms_pico/wiki/Admin-Settings#apache-configuration

Missing logo under personal settings

the "WWW" in a circle logo shows up under the admin settings, but not under the personal settings side bar.

Limit to group feature breaks public accessibility

When you limit the app to groups than pages are not publicly accessible anymore unless you are logged into the nextcloud as a member of the group.

Search feature

At my company, we use cms_pico as a wiki, thanks to the markdown editor plugin the pages are easy to edit, thanks to nextant we can search for content in our .md files, and thanks to nextcloud, files are versioned.

It would be perfect, but we are missing a feature: We would like to be able to search from the rendered website, instead of searching from the nextcloud interface. It would be great to have a search box in the rendered interface, that would return results from the website content (and only from the website content).

What do you think? Is it a planned feature? We may consider to develop it ourselves and propose a pull request or a plugin (but not in a near future). If so, do you have technical clues to give us?

Reloading site causes CSRF errors in Nextcloud

Steps to reproduce:

1. Create a PicoCMS site in tab 1
2. Load PicoCMS site in tab 2
3. Make changes to the index.md frontpage in tab 1
4. Reload the site in tab 2 to show the changes

This will cause a CSRF failure in tab 1, forcing me to refresh the page before I can continue editing the site.

Can't pico-cms be used if nc is installed in a subdirectory?

My NC installation doesn't use its own subdomain but resides in DOMAIN/cloud. Installing PicoCMS is fine but seems not to work correctly since adding a test site yields DOMAIN/sites/test whereas I'd expect it to go to DOMAIN/cloud/sites/test. Actually, DOMAIN/sites/test yields 404.