* Fix a security hole that allowed insertion of unsafe content via the meta

[git.ikiwiki.info.git] / IkiWiki.pm

diff --git a/IkiWiki.pm b/IkiWiki.pm
index ed74ff85e65daff5e8c6c76be5b02ef3c0f4733e..9e71cc153c4aaaad37328bb3eb74b947d2084ae8 100644 (file)
--- a/IkiWiki.pm
+++ b/IkiWiki.pm
@@ -5,6 +5,7 @@ use warnings;
 use strict;
 use Encode;
 use HTML::Entities;
+use URI::Escape q{uri_escape_utf8};
 use open qw{:utf8 :std};
 
 use vars qw{%config %links %oldlinks %oldpagemtime %pagectime %pagecase
@@ -17,9 +18,7 @@ our @EXPORT = qw(hook debug error template htmlpage add_depends pagespec_match
                  displaytime will_render gettext
                  %config %links %renderedfiles %pagesources);
 our $VERSION = 1.02; # plugin interface version, next is ikiwiki version
-our $version='unknown'; # VERSION_AUTOREPLACE done by Makefile, DNE
-my $installdir=''; # INSTALLDIR_AUTOREPLACE done by Makefile, DNE
-
+our $version="1.45";my $installdir="/usr";
 # Optimisation.
 use Memoize;
 memoize("abs2rel");
@@ -378,10 +377,17 @@ sub titlepage ($) { #{{{
        return $title;
 } #}}}
 
+sub linkpage ($) { #{{{
+       my $link=shift;
+       $link=~s/([^-[:alnum:]:+\/._])/$1 eq ' ' ? '_' : "__".ord($1)."__"/eg;
+       return $link;
+} #}}}
+
 sub cgiurl (@) { #{{{
        my %params=@_;
 
-       return $config{cgiurl}."?".join("&", map "$_=$params{$_}", keys %params);
+       return $config{cgiurl}."?".
+               join("&", map $_."=".uri_escape_utf8($params{$_}), keys %params);
 } #}}}
 
 sub baseurl (;$) { #{{{
@@ -449,7 +455,11 @@ sub htmllink ($$$;@) { #{{{
        if (! grep { $_ eq $bestlink } map { @{$_} } values %renderedfiles) {
                return $linktext unless length $config{cgiurl};
                return "<span><a href=\"".
-                       cgiurl(do => "create", page => lc($link), from => $page).
+                       cgiurl(
+                               do => "create",
+                               page => pagetitle(lc($link), 1),
+                               from => $lpage
+                       ).
                        "\">?</a>$linktext</span>"
        }
        
@@ -498,19 +508,25 @@ sub linkify ($$$) { #{{{
 
        $content =~ s{(\\?)$config{wiki_link_regexp}}{
                defined $2
-                       ? ( $1 ? "[[$2|$3]]" : htmllink($lpage, $page, titlepage($3), anchor => $4, linktext => pagetitle($2)))
-                       : ( $1 ? "[[$3]]"    : htmllink($lpage, $page, titlepage($3), anchor => $4))
+                       ? ( $1 ? "[[$2|$3]]" : htmllink($lpage, $page, linkpage($3), anchor => $4, linktext => pagetitle($2)))
+                       : ( $1 ? "[[$3]]"    : htmllink($lpage, $page, linkpage($3), anchor => $4))
        }eg;
        
        return $content;
 } #}}}
 
 my %preprocessing;
-sub preprocess ($$$;$) { #{{{
+our $preprocess_preview=0;
+sub preprocess ($$$;$$) { #{{{
        my $page=shift; # the page the data comes from
        my $destpage=shift; # the page the data will appear in (different for inline)
        my $content=shift;
        my $scan=shift;
+       my $preview=shift;
+
+       # Using local because it needs to be set within any nested calls
+       # of this function.
+       local $preprocess_preview=$preview if defined $preview;
 
        my $handle=sub {
                my $escape=shift;
@@ -562,6 +578,7 @@ sub preprocess ($$$;$) { #{{{
                                @params,
                                page => $page,
                                destpage => $destpage,
+                               preview => $preprocess_preview,
                        );
                        $preprocessing{$page}--;
                        return $ret;