cherry-pick uri security fix

[git.ikiwiki.info.git] / doc / plugins / write.mdwn

diff --git a/doc/plugins/write.mdwn b/doc/plugins/write.mdwn
index 79da6a6122be8f43bc5d4092a5bc6f6a7b7748ee..e1e057c007888fd44b5a41a1cd1c31f4b8a64cde 100644 (file)
--- a/doc/plugins/write.mdwn
+++ b/doc/plugins/write.mdwn
@@ -222,8 +222,11 @@ source files that were rendered.
 
 Use this to hook into ikiwiki's cgi script. Each registered cgi hook is
 called in turn, and passed a CGI object. The hook should examine the
 
 Use this to hook into ikiwiki's cgi script. Each registered cgi hook is
 called in turn, and passed a CGI object. The hook should examine the

-parameters, and if it will handle this CGI request, output a page (including the http headers) and
-terminate the program.
+parameters, and if it will handle this CGI request, output a page
+(including the http headers) and terminate the program.
+
+Note that cgi hooks are called as early as possible, before any ikiwiki
+state is loaded, and with no session information.

 
 ### auth
 
 
 ### auth
 


@@ -478,8 +481,13 @@ If the destination directory doesn't exist, it will first be created.
 
 Given a page name and a destination file name (not including the base
 destination directory), register that the page will result in that file
 
 Given a page name and a destination file name (not including the base
 destination directory), register that the page will result in that file

-being rendered. It's important to call this before writing to any file in
-the destination directory.
+being rendered. 
+
+It's important to call this before writing to any file in the destination
+directory, and it's important to call it consistently every time, even if
+the file isn't really written this time -- unless you delete any old
+version of the file. In particular, in preview mode, this should still be
+called even if the file isn't going to be written to during the preview.

 
 Ikiwiki uses this information to automatically clean up rendered files when
 the page that rendered them goes away or is changes to no longer render
 
 Ikiwiki uses this information to automatically clean up rendered files when
 the page that rendered them goes away or is changes to no longer render


@@ -533,18 +541,16 @@ rendered to.
 
 ## Internal use pages
 
 
 ## Internal use pages
 

-Sometimes it's useful to put pages in the wiki without having them be
-rendered to individual html files. Such internal use pages are collected
-together to form the RecentChanges page, for example.
+Sometimes it's useful to put pages in the wiki without the overhead of
+having them be rendered to individual html files. Such internal use pages
+are collected together to form the RecentChanges page, for example.

 
 To make an internal use page, register a filename extension that starts
 
 To make an internal use page, register a filename extension that starts

-with "_". Internal use pages cannot be edited with the web interface, are
-not scanned for wikilinks (though wikilinks and preprocessor directives can
-appear on them, this is rarely a good idea and should be done with caution),
-and are not matched by regular PageSpecs glob patterns, but instead only by a
-special `internal()` [[ikiwiki/PageSpec]].
-
-Ikiwiki is optimised to handle lots of internal use pages, very quickly.
+with "_". Internal use pages cannot be edited with the web interface,
+generally shouldn't contain wikilinks or preprocessor directives (use
+either on them with extreme caution), and are not matched by regular
+PageSpecs glob patterns, but instead only by a special `internal()`
+[[ikiwiki/PageSpec]].

 
 ## RCS plugins
 
 
 ## RCS plugins