passwordauth: prevent authentication bypass via multiple name parameters

[git.ikiwiki.info.git] / IkiWiki / Plugin / cvs.pm

diff --git a/IkiWiki/Plugin/cvs.pm b/IkiWiki/Plugin/cvs.pm
index bccab3159b494cfc7f0757ec224f9f8be8ed8409..f6f7edfb2855107674154bef114d8c434fe8452a 100644 (file)
--- a/IkiWiki/Plugin/cvs.pm
+++ b/IkiWiki/Plugin/cvs.pm
@@ -1,11 +1,11 @@
 #!/usr/bin/perl
 package IkiWiki::Plugin::cvs;
 
-# Copyright (c) 2009 Amitai Schlair
+# Copyright (c) 2009 Amitai Schleier
 # All rights reserved.
 #
 # This code is derived from software contributed to ikiwiki
-# by Amitai Schlair.
+# by Amitai Schleier.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -314,7 +314,9 @@ sub rcs_recentchanges ($) {
                        $oldrev =~ s/INITIAL/0/;
                        $newrev =~ s/\(DEAD\)//;
                        my $diffurl = defined $config{diffurl} ? $config{diffurl} : "";
-                       my $epage = uri_escape_utf8($page);
+                       my $epage = join('/',
+                               map { uri_escape_utf8($_) } split('/', $page)
+                       );
                        $diffurl=~s/\[\[file\]\]/$epage/g;
                        $diffurl=~s/\[\[r1\]\]/$oldrev/g;
                        $diffurl=~s/\[\[r2\]\]/$newrev/g;
@@ -454,12 +456,12 @@ sub commitmessage (@) {
        if (defined $params{session}) {
                if (defined $params{session}->param("name")) {
                        return "web commit by ".
-                               $params{session}->param("name").
+                               IkiWiki::cloak($params{session}->param("name")).
                                (length $params{message} ? ": $params{message}" : "");
                }
                elsif (defined $params{session}->remote_addr()) {
                        return "web commit from ".
-                               $params{session}->remote_addr().
+                               IkiWiki::cloak($params{session}->remote_addr()).
                                (length $params{message} ? ": $params{message}" : "");
                }
        }