]> git.vanrenterghem.biz Git - git.ikiwiki.info.git/blob - IkiWiki/Plugin/meta.pm
Fix CSRF attacks against the preferences and edit forms. Closes: #475445
[git.ikiwiki.info.git] / IkiWiki / Plugin / meta.pm
1 #!/usr/bin/perl
2 # Ikiwiki metadata plugin.
3 package IkiWiki::Plugin::meta;
5 use warnings;
6 use strict;
7 use IkiWiki;
9 my %meta;
10 my %title;
11 my %permalink;
12 my %author;
13 my %authorurl;
15 sub import { #{{{
16         hook(type => "preprocess", id => "meta", call => \&preprocess, scan => 1);
17         hook(type => "filter", id => "meta", call => \&filter);
18         hook(type => "pagetemplate", id => "meta", call => \&pagetemplate);
19 } # }}}
21 sub filter (@) { #{{{
22         my %params=@_;
23         
24         $meta{$params{page}}='';
26         return $params{content};
27 } # }}}
29 sub scrub ($) { #{{{
30         if (IkiWiki::Plugin::htmlscrubber->can("sanitize")) {
31                 return IkiWiki::Plugin::htmlscrubber::sanitize(content => shift);
32         }
33         else {
34                 return shift;
35         }
36 } #}}}
38 sub safeurl ($) { #{{{
39         my $url=shift;
40         if (exists $IkiWiki::Plugin::htmlscrubber::{safe_url_regexp} &&
41             defined $IkiWiki::Plugin::htmlscrubber::safe_url_regexp) {
42                 return $url=~/$IkiWiki::Plugin::htmlscrubber::safe_url_regexp/;
43         }
44         else {
45                 return 1;
46         }
47 } #}}}
49 sub preprocess (@) { #{{{
50         if (! @_) {
51                 return "";
52         }
53         my %params=@_;
54         my $key=shift;
55         my $value=$params{$key};
56         delete $params{$key};
57         my $page=$params{page};
58         delete $params{page};
59         delete $params{destpage};
61         eval q{use HTML::Entities};
62         # Always dencode, even if encoding later, since it might not be
63         # fully encoded.
64         $value=decode_entities($value);
66         if ($key eq 'link') {
67                 if (%params) {
68                         $meta{$page}.=scrub("<link href=\"".encode_entities($value)."\" ".
69                                 join(" ", map { encode_entities($_)."=\"".encode_entities(decode_entities($params{$_}))."\"" } keys %params).
70                                 " />\n");
71                 }
72                 else {
73                         # hidden WikiLink
74                         push @{$links{$page}}, $value;
75                 }
76         }
77         elsif ($key eq 'title') {
78                 $title{$page}=encode_entities($value);
79         }
80         elsif ($key eq 'permalink') {
81                 if (safeurl($value)) {
82                         $permalink{$page}=$value;
83                         $meta{$page}.=scrub("<link rel=\"bookmark\" href=\"".encode_entities($value)."\" />\n");
84                 }
85         }
86         elsif ($key eq 'stylesheet') {
87                 my $rel=exists $params{rel} ? $params{rel} : "alternate stylesheet";
88                 my $title=exists $params{title} ? $params{title} : $value;
89                 # adding .css to the value prevents using any old web
90                 # editable page as a stylesheet
91                 my $stylesheet=bestlink($page, $value.".css");
92                 if (! length $stylesheet) {
93                         return "[[meta ".gettext("stylesheet not found")."]]";
94                 }
95                 $meta{$page}.='<link href="'.$stylesheet.
96                         '" rel="'.encode_entities($rel).
97                         '" title="'.encode_entities($title).
98                         "\" style=\"text/css\" />\n";
99         }
100         elsif ($key eq 'openid') {
101                 if (exists $params{server} && safeurl($params{server})) {
102                         $meta{$page}.='<link href="'.encode_entities($params{server}).
103                                 "\" rel=\"openid.server\" />\n";
104                 }
105                 if (safeurl($value)) {
106                         $meta{$page}.='<link href="'.encode_entities($value).
107                                 "\" rel=\"openid.delegate\" />\n";
108                 }
109         }
110         else {
111                 $meta{$page}.=scrub("<meta name=\"".encode_entities($key).
112                         "\" content=\"".encode_entities($value)."\" />\n");
113                 if ($key eq 'author') {
114                         $author{$page}=$value;
115                 }
116                 elsif ($key eq 'authorurl' && safeurl($value)) {
117                         $authorurl{$page}=$value;
118                 }
119         }
121         return "";
122 } # }}}
124 sub pagetemplate (@) { #{{{
125         my %params=@_;
126         my $page=$params{page};
127         my $template=$params{template};
129         $template->param(meta => $meta{$page})
130                 if exists $meta{$page} && $template->query(name => "meta");
131         if (exists $title{$page} && $template->query(name => "title")) {
132                 $template->param(title => $title{$page});
133                 $template->param(title_overridden => 1);
134         }
135         $template->param(permalink => $permalink{$page})
136                 if exists $permalink{$page} && $template->query(name => "permalink");
137         $template->param(author => $author{$page})
138                 if exists $author{$page} && $template->query(name => "author");
139         $template->param(authorurl => $authorurl{$page})
140                 if exists $authorurl{$page} && $template->query(name => "authorurl");
141         
142 } # }}}