3.20141016.3 (for jessie-security)

[git.ikiwiki.info.git] / IkiWiki / CGI.pm

diff --git a/IkiWiki/CGI.pm b/IkiWiki/CGI.pm
index 0224c2aac34d442c47b04e80d13a06db083fa8e2..a6c0c271258b2f9dca1692c89ae3ce6b5d20631e 100644 (file)
--- a/IkiWiki/CGI.pm
+++ b/IkiWiki/CGI.pm
@@ -122,7 +122,8 @@ sub decode_cgi_utf8 ($) {
        if ($] < 5.01) {
                my $cgi = shift;
                foreach my $f ($cgi->param) {
-                       $cgi->param($f, map { decode_utf8 $_ } $cgi->param($f));
+                       $cgi->param($f, map { decode_utf8 $_ }
+                               @{$cgi->param_fetch($f)});
                }
        }
 }
@@ -490,6 +491,9 @@ sub cgi (;$$) {
 sub cgierror ($) {
        my $message=shift;
 
+       eval q{use HTML::Entities};
+       $message = encode_entities($message);
+
        print "Content-type: text/html\n\n";
        print cgitemplate(undef, gettext("Error"),
                "<p class=\"error\">".gettext("Error").": $message</p>");