yes, not committing the setup file to the same VCS is a security thing

[git.ikiwiki.info.git] / IkiWiki / Plugin / darcs.pm

diff --git a/IkiWiki/Plugin/darcs.pm b/IkiWiki/Plugin/darcs.pm
index 1313041e78fe9c61588c04a53bae58e4e22d33d5..9dccd95a43766c34c144ad51e6076418f97b3d54 100644 (file)
--- a/IkiWiki/Plugin/darcs.pm
+++ b/IkiWiki/Plugin/darcs.pm
@@ -3,6 +3,7 @@ package IkiWiki::Plugin::darcs;
 
 use warnings;
 use strict;
+use URI::Escape q{uri_escape_utf8};
 use IkiWiki;
 
 sub import {
@@ -146,10 +147,10 @@ sub commitauthor (@) {
        my $author="anon\@web";
        if (defined $params{session}) {
                if (defined $params{session}->param("name")) {
-                       return $params{session}->param("name").'@web';
+                       return IkiWiki::cloak($params{session}->param("name")).'@web';
                }
                elsif (defined $params{session}->remote_addr()) {
-                       return $params{session}->remote_addr().'@web';
+                       return IkiWiki::cloak($params{session}->remote_addr()).'@web';
                }
        }
        return 'anon@web';
@@ -336,7 +337,8 @@ sub rcs_recentchanges ($) {
 
                foreach my $f (@files) {
                        my $d = defined $config{'diffurl'} ? $config{'diffurl'} : "";
-                       $d =~ s/\[\[file\]\]/$f/go;
+                       my $ef = uri_escape_utf8($f);
+                       $d =~ s/\[\[file\]\]/$ef/go;
                        $d =~ s/\[\[hash\]\]/$hash/go;
 
                        push @pg, {