Index: openacs-4/packages/acs-api-browser/www/content-page-view.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-api-browser/www/content-page-view.tcl,v
diff -u -N -r1.5 -r1.6
--- openacs-4/packages/acs-api-browser/www/content-page-view.tcl	25 Nov 2010 09:17:23 -0000	1.5
+++ openacs-4/packages/acs-api-browser/www/content-page-view.tcl	27 Oct 2014 16:38:59 -0000	1.6
@@ -2,25 +2,25 @@
     Displays information about a content page.
     
     @param version_id the id of the package version the file belongs to
-    @param path the path and filename of the page to document, relative to [acs_root_dir]
+    @param path the path and filename of the page to document, relative to $::acs::rootdir
     
     @author Jon Salz (jsalz@mit.edu)
     @author Lars Pind (lars@pinds.com)
     @creation-date 1 July 2000
     
     @cvs-id $Id$
 } {
-    version_id:integer,optional
+    version_id:naturalnum,optional
     source_p:integer,optional,trim
-    path
+    path:trim
 } -properties {
     title:onevalue
     context:onevalue
     script_documentation:onevalue
 }
 
 set context [list]
-set url_vars [export_url_vars path version_id]
+set url_vars [export_vars -url {path version_id}]
 set return_url [ns_urlencode [ad_conn url]?][ns_urlencode $url_vars]
 set default_source_p [ad_get_client_property -default 0 acs-api-browser api_doc_source_p]
 
@@ -29,7 +29,7 @@
 }
 
 if { ![info exists version_id] && \
-        [regexp {^packages/([^ /]+)/} $path "" package_key] } {
+        [regexp {^packages/([^ /]+)/} $path . package_key] } {
     db_0or1row version_id_from_package_key {
         select version_id 
           from apm_enabled_package_versions 
@@ -38,46 +38,49 @@
 }
 
 if { [info exists version_id] } {
-    db_1row package_info_from_version_id {
+    db_0or1row package_info_from_version_id {
         select pretty_name, package_key, version_name
           from apm_package_version_info
          where version_id = :version_id
     }
-    lappend context [list "package-view?version_id=$version_id&kind=content" "$pretty_name $version_name"]
+    if {[info exists pretty_name]} {
+        lappend context [list "package-view?version_id=$version_id&kind=content" "$pretty_name $version_name"]
+    }
 }
 
-
-
 lappend context [file tail $path]
+set path [apidoc::sanitize_path $path]
 
-set filename "[acs_root_dir]/$path"
-
-if {[regsub -all {[.][.]/} $filename "" shortened_filename]} {
-    ns_log notice "INTRUDER ALERT:\n\nsomesone tried to snarf '$filename'!\n  file exists: [file exists $filename]\n  user_id: [ad_conn user_id]\n  peer: [ad_conn peeraddr]\n"
-    set filename shortened_filename
+if {![file readable $::acs::rootdir/$path] || [file isdirectory $::acs::rootdir/$path]} {
+    if {[info exists version_id]} {
+	set kind content
+	set href [ad_conn package_url]/package-view?[export_vars {version_id {kind procs}}]
+	set link [subst {<p>Go back to <a href="$href">Package Documentation</a>.}]
+    } else {
+	set link [subst {<p>Go back to <a href="[ad_conn package_url]">API Browser</a>.}]
+    }
+    ad_return_warning "No such content page" [subst {
+	The file '$path' was not found. Maybe the url contains a typo.
+	$link
+    }]
+    return
 }
 
-if {![file exists $filename] || [file isdirectory $filename]} {
-    set file_contents "file '$filename' not found"
+set mime_type [ns_guesstype $path]
+if {![string match "text/*" $mime_type]} {
+    set source_p 0
+    set source_link 0
 } else {
-    if { $source_p } {
-        if {[catch {
-        
-            set fd [open $filename r]
-            set file_contents [read $fd]
-            close $fd
-        
-        } err ]} {
-            set file_contents "error opening '$filename'\n$err"
-        } else {
-            set file_contents [ad_quotehtml $file_contents]
-        }
-    }
-
-    template::util::list_to_multirow xql_links [api_xql_links_list $path]
+    set source_link 1
 }
+if { $source_p } {
+    set file_contents [template::util::read_file $::acs::rootdir/$path]
+    set file_contents [apidoc::tclcode_to_html $file_contents]
+}
 
+template::util::list_to_multirow xql_links [::apidoc::xql_links_list $path]
 
+
 set title [file tail $path]
 set script_documentation [api_script_documentation $path]