--- /home/shugo/src/lilyset/lily.cgi	2004-05-23 05:38:00.000000000 +0900
+++ lily.cgi	2004-05-28 16:42:13.000000000 +0900
@@ -10,20 +10,6 @@
 rescue LoadError
 end
 
-class String
-  def to_euc
-    NKF::nkf( '-m0 -e', self )
-  end
-
-  def to_sjis
-    NKF::nkf( '-m0 -s', self )
-  end
-
-  def to_jis
-    NKF::nkf( '-m0 -j', self )
-  end
-end
-
 class Lily
 
   def initialize(cgi,env)
@@ -53,9 +39,13 @@
     @env = env
 
     Dir.glob("#{@plugindir}/*.rb") do |f|
-      File::open(f,"r"){|src|
+      File::open(f.untaint,"r"){|src|
         begin
-          self.instance_eval(src.read)
+          s = "eval(<<'END_OF_PLUGIN', nil, #{f.dump}, 0)\n"
+          s << src.read
+          s << "END_OF_PLUGIN\n"
+          s.untaint
+          self.instance_eval(s)
         rescue Exception
         end
       }
@@ -74,7 +64,7 @@
     
     File::open(__FILE__) do |data|
       data.gets("__END__\n")
-      eval data.read
+      eval data.read.untaint
     end
   end
 
@@ -99,7 +89,7 @@
         eval("@#{name}")
       end
     rescue NameError
-      error_out()
+      error_out(@cgi)
     end
   end
   
@@ -122,19 +112,19 @@
         begin
           Uconv.u8tosjis(str)
         rescue Exception
-          str.tosjis
+          NKF::nkf('-m0 -s', str)
         end
       elsif @encode == "jis"
         begin
           Uconv.u8tosjis(str).tojis
         rescue Exception
-          str.tojis
+          NKF::nkf('-m0 -j', str)
         end
       elsif @encode == "euc"
         begin
           Uconv.u8toeuc(str)
         rescue Exception
-          str.toeuc
+          NKF::nkf('-m0 -e', str)
         end
       elsif @encode == "utf-8"
         begin
@@ -179,7 +169,7 @@
         @flavour = $2
         if $1 != "index"
           @file_extension.each do |fext|
-            if File.file?("#{@datadir}/#{@path_info}/#{$1}.#{fext}")
+            if File.file?("#{@datadir}/#{@path_info}/#{$1}.#{fext}".untaint)
               @path_info << "/#{$1}.#{fext}"
               break
             end
@@ -208,21 +198,23 @@
     @path_info.sub!(/^\/+/,"/")
     @path_info.sub!(/^\/$/,"")
     
-    if File.file?("#{@datadir}/#{@path_info}")
-      @storys.push("#{@datadir}/#{@path_info}")
+    story = "#{@datadir}/#{@path_info}".untaint
+    if File.file?(story)
+      @storys.push(story)
     else
       files = []
       if @depth == 0
         @file_extension.each do |fext|
-          files += Dir.glob("#{@datadir}/#{@path_info}/*.#{fext}")
+          files += Dir.glob("#{@datadir}/#{@path_info}/*.#{fext}".untaint)
         end
       else
         @file_extension.each do |fext|
-          files += Dir.glob("#{@datadir}/#{@path_info}/**/*.#{fext}")
+          files += Dir.glob("#{@datadir}/#{@path_info}/**/*.#{fext}".untaint)
         end
       end
 
       files.each{|f|
+        f.untaint
         day = get_post_time(f)
         if @path_info_yr.nil? or @path_info_yr == ""
           @storys.push(f)
@@ -264,7 +256,7 @@
     
     Dir.glob("#{@plugindir}/*.rb"){|f|
       begin
-        eval("#{File.basename(f,".*")}")
+        eval("#{File.basename(f,".*")}".untaint)
       rescue NameError
       end
     }
@@ -272,16 +264,19 @@
     unless @echo_off
       begin
         File.open("#{@flavourdir}/content_type.#{@flavour}","r"){|f|
-          print "Content-type: #{f.gets.chomp};charset=#{enc_char}\n\n";
+          print @cgi.header("type" => f.gets.chomp,
+                            "charset" => enc_char)
         }
       rescue Exception
-        print "Content-type: text/html;charset=#{enc_char}\n\n";
+        print @cgi.header("type" => "text/html",
+                          "charset" => enc_char)
       end
 
       disp_head
 
       @prev_story_date = nil
       @storys.each do |f|
+        f.untaint
         disp_date(f)
         disp_story(f)
       end
@@ -292,10 +287,10 @@
   
   def disp_head
     begin
-      File::open("#{@flavourdir}/head.#{@flavour}","r"){|f|
+      File::open("#{@flavourdir}/head.#{@flavour}".untaint,"r"){|f|
         str = f.read.gsub(/\$([a-z][a-z0-9_:]*)/){ 
                   "\#{get_conf(\"#{$1}\")}" }
-        eval("print <<EOS\n#{convert(str)}\nEOS")
+        eval("print <<EOS\n#{convert(str)}\nEOS".untaint)
       }
     rescue Exception
       @default_head.gsub!(/\$([a-z][a-z0-9_:]*)/){ 
@@ -337,7 +332,7 @@
       end
     end
     
-    eval("print <<EOS\n#{convert(@date_tmpl)}\nEOS")
+    eval("print <<EOS\n#{convert(@date_tmpl)}\nEOS".untaint)
   end
   
   def disp_story(file)
@@ -351,13 +346,13 @@
 
     Dir.glob("#{@plugindir}/*.rb"){|f|
       begin
-        eval("#{File.basename(f,".*")}_filter")
+        eval("#{File.basename(f,".*")}_filter".untaint)
       rescue NameError
       end
     }
     if @story_tmpl.nil?
       begin
-        File::open("#{@flavourdir}/story.#{@flavour}","r"){|f|
+        File::open("#{@flavourdir}/story.#{@flavour}".untaint,"r"){|f|
           str = f.read.gsub(/\$([a-z][a-z0-9_:]*)/){ 
                     "\#{get_conf(\"#{$1}\")}" }
           @story_tmpl = str.gsub!(/\n/,'')
@@ -368,27 +363,27 @@
       end
     end
     
-    eval("print <<EOS\n#{convert(@story_tmpl)}\nEOS")
+    eval("print <<EOS\n#{convert(@story_tmpl)}\nEOS".untaint)
   end
   
   def disp_foot
     begin
-      File::open("#{@flavourdir}/foot.#{@flavour}","r"){|f|
+      File::open("#{@flavourdir}/foot.#{@flavour}".untaint,"r"){|f|
         str = f.read.gsub(/\$([a-z][a-z0-9_:]*)/){ 
                   "\#{get_conf(\"#{$1}\")}" }
-        eval("print <<EOS\n#{convert(str)}\nEOS")
+        eval("print <<EOS\n#{convert(str)}\nEOS".untaint)
       }
     rescue Exception
       @default_foot.gsub!(/\$([a-z][a-z0-9_:]*)/){ 
                 "\#{get_conf(\"#{$1}\")}" }
-      eval("print <<EOS\n#{convert(@default_foot)}\nEOS")
+      eval("print <<EOS\n#{convert(@default_foot)}\nEOS".untaint)
     end
   end
 
 end
 
-def error_out
-  print "Content-Type:text/html\n\n"
+def error_out(cgi)
+  print cgi.header("type" => "text/html")
   print $!,"<BR>";
   $@.each {|x| print CGI.escapeHTML(x), "<BR>\n"}
 end
@@ -399,21 +394,22 @@
   File::open("./lily.cfg","r"){|f|
     f.read.each_line do |line|
       item = line.chomp.split(/\s+/)
-      key = item.shift
-      env[key] = item.join(' ')
+      key = item.shift.untaint
+      env[key] = item.join(' ').untaint
     end
   }
   
   return env
 end
 
-if __FILE__ == $0
+if __FILE__ == $0 || __FILE__ == ENV["SCRIPT_FILENAME"]
+  cgi = CGI.new
   begin
     env  = load_env
-    blog = Lily.new(CGI.new, env)
+    blog = Lily.new(cgi, env)
     blog.disp
   rescue Exception
-    error_out()
+    error_out(cgi)
   end
 end
 
diff -ur --ignore-all-space --strip-trailing-cr plugin/archives.rb /home/shugo/src/lilyset/plugin/archives.rb
--- plugin/archives.rb	2004-05-28 16:08:07.000000000 +0900
+++ /home/shugo/src/lilyset/plugin/archives.rb	2004-05-22 03:00:22.000000000 +0900
@@ -12,7 +12,6 @@
   end
 
   files.each do |f|
-    f.untaint
     ti = get_post_time(f)
     if ar[ti.year] then
       if ar[ti.year][ti.mon] then
diff -ur --ignore-all-space --strip-trailing-cr plugin/category.rb /home/shugo/src/lilyset/plugin/category.rb
--- plugin/category.rb	2004-05-28 15:24:54.000000000 +0900
+++ /home/shugo/src/lilyset/plugin/category.rb	2004-05-22 03:35:28.000000000 +0900
@@ -3,12 +3,12 @@
 
 def categories_categories(path = @datadir)
   src = ""
-  Dir.foreach(path.untaint){|d|
+  Dir.foreach(path){|d|
     fulld = "#{path}/#{d}"
     if d != "." and d != ".."then
       fs = []
       @file_extension.each do |fext|
-        fs += Dir.glob("#{fulld}/**/*.#{fext}".untaint)
+        fs += Dir.glob("#{fulld}/**/*.#{fext}")
       end
       if !fs.nil? and fs.size > 0 then
         pi = fulld.sub("#{@datadir}/","")
diff -ur --ignore-all-space --strip-trailing-cr plugin/headline.rb /home/shugo/src/lilyset/plugin/headline.rb
--- plugin/headline.rb	2004-05-28 16:00:17.000000000 +0900
+++ /home/shugo/src/lilyset/plugin/headline.rb	2004-05-22 16:44:18.000000000 +0900
@@ -5,9 +5,6 @@
   @file_extension.each do |fext|
     files += Dir.glob("#{@datadir}/**/*.#{fext}")
   end
-  files.each do |f|
-    f.untaint
-  end
 
   @head_line = files.sort{|a,b| get_post_time(b) <=> get_post_time(a)}[0,count]
 end
@@ -19,7 +16,7 @@
     title = ''
     path = ''
     fn = ''
-    File::open(entry.untaint,"r"){|f|
+    File::open(entry,"r"){|f|
       title = convert(f.gets.chomp)
       reg = Regexp.new("#{@datadir}/(.*)/([^.]*)\.(.*)")
       entry.sub(reg){ path = $1; fn = $2; }
diff -ur --ignore-all-space --strip-trailing-cr plugin/referer.rb /home/shugo/src/lilyset/plugin/referer.rb
--- plugin/referer.rb	2004-05-28 15:20:54.000000000 +0900
+++ /home/shugo/src/lilyset/plugin/referer.rb	2004-05-23 12:18:50.000000000 +0900
@@ -17,12 +17,12 @@
 
   if !@cgi.referer.nil? and @cgi.referer != ''
     unless @cgi.referer =~ /#{@hide_dmain}/
-      File.open("#{@refererdir}/#{CGI.escape(path)}".untaint, 'a'){|file|
+      File.open("#{@refererdir}/#{CGI.escape(path)}", 'a'){|file|
         file.print "#{@cgi.referer}\n"
       }
     end
   else
-    File.open("#{@refererdir}/#{CGI.escape(path)}".untaint, 'a'){|file|
+    File.open("#{@refererdir}/#{CGI.escape(path)}", 'a'){|file|
       file.print "noreferer\n"
     }
   end
diff -ur --ignore-all-space --strip-trailing-cr plugin/search.rb /home/shugo/src/lilyset/plugin/search.rb
--- plugin/search.rb	2004-05-28 16:24:13.000000000 +0900
+++ /home/shugo/src/lilyset/plugin/search.rb	2004-05-22 04:06:38.000000000 +0900
@@ -9,7 +9,6 @@
     end
     
     files.each {|f|
-      f.untaint
       File::open(f){|fh|
         fh.each{|line|
           if convert(line).include?(word) then
diff -ur --ignore-all-space --strip-trailing-cr plugin/trackback.rb /home/shugo/src/lilyset/plugin/trackback.rb
--- plugin/trackback.rb	2004-05-28 15:51:07.000000000 +0900
+++ /home/shugo/src/lilyset/plugin/trackback.rb	2004-05-22 15:12:28.000000000 +0900
@@ -28,8 +28,9 @@
           end
         }
 
-        print @cgi.header("type" => "text/xml")
         print <<EOS
+Content-type: text/xml;
+
 <?xml version="1.0" encoding="utf-8"?>
 <response>
 <error>0</error>
@@ -90,8 +91,9 @@
         f.puts CGI.escapeHTML(blog_name)
         f.puts CGI.escapeHTML(excerpt)
         f.puts '--------'
-        print @cgi.header("type" => "text/html")
         print <<EOS
+Content-type: text/html
+
 <?xml version="1.0" encoding="iso-8859-1"?>
 <response>
 <error>0</error>
