passwordauth: avoid userinfo forgery via repeated email parameter

[git.ikiwiki.info.git] / IkiWiki / Plugin / svn.pm

diff --git a/IkiWiki/Plugin/svn.pm b/IkiWiki/Plugin/svn.pm
index 8824a6ce0a60311cac8ec304258b545e661eea83..fd11f2c637597d98915f6a5bc29fc03ff6d0c572 100644 (file)
--- a/IkiWiki/Plugin/svn.pm
+++ b/IkiWiki/Plugin/svn.pm
@@ -5,6 +5,7 @@ use warnings;
 use strict;
 use IkiWiki;
 use POSIX qw(setlocale LC_CTYPE);
+use URI::Escape q{uri_escape_utf8};
 
 sub import {
        hook(type => "checkconfig", id => "svn", call => \&checkconfig);
@@ -292,7 +293,8 @@ sub rcs_recentchanges ($) {
                        }
 
                        my $diffurl=defined $config{diffurl} ? $config{diffurl} : "";
-                       $diffurl=~s/\[\[file\]\]/$file/g;
+                       my $efile = uri_escape_utf8($file);
+                       $diffurl=~s/\[\[file\]\]/$efile/g;
                        $diffurl=~s/\[\[r1\]\]/$rev - 1/eg;
                        $diffurl=~s/\[\[r2\]\]/$rev/g;