comments: Fix XSS security hole due to missing validation of page name. CVE-2011...

[git.ikiwiki.info.git] / IkiWiki / Plugin / comments.pm

diff --git a/IkiWiki/Plugin/comments.pm b/IkiWiki/Plugin/comments.pm
index 64eb7fb093fce0d8dbb1d8437f829f5c4aa31b6d..6bacd26c7832ae75ecd5b6d4dea97b4a6c244453 100644 (file)
--- a/IkiWiki/Plugin/comments.pm
+++ b/IkiWiki/Plugin/comments.pm
@@ -22,6 +22,7 @@ sub import {
        hook(type => "checkconfig", id => 'comments',  call => \&checkconfig);
        hook(type => "getsetup", id => 'comments',  call => \&getsetup);
        hook(type => "preprocess", id => 'comment', call => \&preprocess);
+       hook(type => "preprocess", id => 'commentmoderation', call => \&preprocess_moderation);
        # here for backwards compatability with old comments
        hook(type => "preprocess", id => '_comment', call => \&preprocess);
        hook(type => "sessioncgi", id => 'comment', call => \&sessioncgi);
@@ -249,6 +250,22 @@ sub preprocess {
        return $content;
 }
 
+sub preprocess_moderation {
+       my %params = @_;
+
+       $params{desc}=gettext("Comment Moderation")
+               unless defined $params{desc};
+
+       if (length $config{cgiurl}) {
+               return '<a href="'.
+                       IkiWiki::cgiurl(do => 'commentmoderation').
+                       '">'.$params{desc}.'</a>';
+       }
+       else {
+               return $params{desc};
+       }
+}
+
 sub sessioncgi ($$) {
        my $cgi=shift;
        my $session=shift;
@@ -347,8 +364,8 @@ sub editcomment ($$) {
        }
 
        # The untaint is OK (as in editpage) because we're about to pass
-       # it to file_pruned anyway
-       my $page = $form->field('page');
+       # it to file_pruned and wiki_file_regexp anyway.
+       my $page = $form->field('page')=~/$config{wiki_file_regexp}/;
        $page = IkiWiki::possibly_foolish_untaint($page);
        if (! defined $page || ! length $page ||
                IkiWiki::file_pruned($page)) {
@@ -567,6 +584,7 @@ sub commentmoderation ($$) {
                my $added=0;
                foreach my $id (keys %vars) {
                        if ($id =~ /(.*)\._comment(?:_pending)?$/) {
+                               $id=decode_utf8($id);
                                my $action=$cgi->param($id);
                                next if $action eq 'Defer' && ! $rejectalldefer;
 
@@ -709,6 +727,10 @@ sub previewcomment ($$$) {
        my $page=shift;
        my $time=shift;
 
+       # Previewing a comment should implicitly enable comment posting mode.
+       my $oldpostcomment=$postcomment;
+       $postcomment=1;
+
        my $preview = IkiWiki::htmlize($location, $page, '_comment',
                        IkiWiki::linkify($location, $page,
                        IkiWiki::preprocess($location, $page,
@@ -727,6 +749,8 @@ sub previewcomment ($$$) {
 
        $template->param(have_actions => 0);
 
+       $postcomment=$oldpostcomment;
+
        return $template->output;
 }
 
@@ -923,14 +947,16 @@ sub match_comment ($$;@) {
        my $page = shift;
        my $glob = shift;
 
-       # To see if it's a comment, check the source file type.
-       # Deal with comments that were just deleted.
-       my $source=exists $IkiWiki::pagesources{$page} ?
-               $IkiWiki::pagesources{$page} :
-               $IkiWiki::delpagesources{$page};
-       my $type=defined $source ? IkiWiki::pagetype($source) : undef;
-       if (! defined $type || $type ne "_comment") {
-               return IkiWiki::FailReason->new("$page is not a comment");
+       if (! $postcomment) {
+               # To see if it's a comment, check the source file type.
+               # Deal with comments that were just deleted.
+               my $source=exists $IkiWiki::pagesources{$page} ?
+                       $IkiWiki::pagesources{$page} :
+                       $IkiWiki::delpagesources{$page};
+               my $type=defined $source ? IkiWiki::pagetype($source) : undef;
+               if (! defined $type || $type ne "_comment") {
+                       return IkiWiki::FailReason->new("$page is not a comment");
+               }
        }
 
        return match_glob($page, "$glob/*", internal => 1, @_);