* htmlscrubber security fix: Block javascript in uris.

[git.ikiwiki.info.git] / IkiWiki / Plugin / recentchanges.pm

diff --git a/IkiWiki/Plugin/recentchanges.pm b/IkiWiki/Plugin/recentchanges.pm
index 8ceb2dfbf9da8036ed08bc56efafda4c284199ae..22f934f2e8becec79e9fc8dfae6f0f1ffbd90949 100644 (file)
--- a/IkiWiki/Plugin/recentchanges.pm
+++ b/IkiWiki/Plugin/recentchanges.pm
@@ -8,8 +8,9 @@ use IkiWiki 2.00;
 sub import { #{{{
        hook(type => "checkconfig", id => "recentchanges", call => \&checkconfig);
        hook(type => "refresh", id => "recentchanges", call => \&refresh);
-       hook(type => "htmlize", id => "_change", call => \&htmlize);
        hook(type => "pagetemplate", id => "recentchanges", call => \&pagetemplate);
+       hook(type => "htmlize", id => "_change", call => \&htmlize);
+       hook(type => "cgi", id => "recentchanges", call => \&cgi);
 } #}}}
 
 sub checkconfig () { #{{{
@@ -27,7 +28,7 @@ sub refresh ($) { #{{{
        
        # delete old and excess changes
        foreach my $page (keys %pagesources) {
-               if ($page=~/^\Q$config{recentchangespage}\E\/change_/ && ! $seen{$page}) {
+               if ($page =~ /\._change$/ && ! $seen{$page}) {
                        unlink($config{srcdir}.'/'.$pagesources{$page});
                }
        }
@@ -51,6 +52,39 @@ sub htmlize (@) { #{{{
        return $params{content};
 } #}}}
 
+sub cgi ($) { #{{{
+       my $cgi=shift;
+       if (defined $cgi->param('do') && $cgi->param('do') eq "recentchanges_link") {
+               # This is a link from a change page to some
+               # other page. Since the change pages are only generated
+               # once, statically, links on them won't be updated if the
+               # page they link to is deleted, or newly created, or
+               # changes for whatever reason. So this CGI handles that
+               # dynamic linking stuff.
+               my $page=$cgi->param("page");
+               if (!defined $page) {
+                       error("missing page parameter");
+               }
+
+               IkiWiki::loadindex();
+
+               my $link=bestlink("", $page);
+               if (! length $link) {
+                       print "Content-type: text/html\n\n";
+                       print IkiWiki::misctemplate(gettext(gettext("missing page")),
+                               "<p>".
+                               sprintf(gettext("The page %s does not exist."),
+                                       htmllink("", "", $page)).
+                               "</p>");
+               }
+               else {
+                       IkiWiki::redirect($cgi, $config{url}."/".htmlpage($link));
+               }
+
+               exit;
+       }
+}
+
 sub store ($$$) { #{{{
        my $change=shift;
 
@@ -65,10 +99,15 @@ sub store ($$$) { #{{{
        delete @{$change->{pages}}[10 .. @{$change->{pages}}] if $is_excess;
        $change->{pages} = [
                map {
-                       if (length $config{url}) {
-                               $_->{link} = "<a href=\"$config{url}/".
-                                       urlto($_->{page},"")."\">".
-                                       IkiWiki::pagetitle($_->{page})."</a>";
+                       if (length $config{cgiurl}) {
+                               $_->{link} = "<a href=\"".
+                                       IkiWiki::cgiurl(
+                                               do => "recentchanges_link",
+                                               page => $_->{page}
+                                       ).
+                                       "\">".
+                                       IkiWiki::pagetitle($_->{page}).
+                                       "</a>"
                        }
                        else {
                                $_->{link} = IkiWiki::pagetitle($_->{page});
@@ -82,15 +121,16 @@ sub store ($$$) { #{{{
 
        # See if the committer is an openid.
        $change->{author}=$change->{user};
-       my $oiduser=IkiWiki::openiduser($change->{user});
+       my $oiduser=eval { IkiWiki::openiduser($change->{user}) };
        if (defined $oiduser) {
                $change->{authorurl}=$change->{user};
                $change->{user}=$oiduser;
        }
-       elsif (length $config{url}) {
-               $change->{authorurl}="$config{url}/".
-                       (length $config{userdir} ? "$config{userdir}/" : "").
-                       $change->{user};
+       elsif (length $config{cgiurl}) {
+               $change->{authorurl} = IkiWiki::cgiurl(
+                       do => "recentchanges_link",
+                       page => (length $config{userdir} ? "$config{userdir}/" : "").$change->{author},
+               );
        }
 
        # escape  wikilinks and preprocessor stuff in commit messages