Revert "Tell `git revert` not to follow renames (CVE-2016-10026)"

[git.ikiwiki.info.git] / IkiWiki / CGI.pm

diff --git a/IkiWiki/CGI.pm b/IkiWiki/CGI.pm
index 5baa6c1798ef02e1f45680daa032da17674fafb0..878869ef1e43888183746f2e7db4b7eda53f538c 100644 (file)
--- a/IkiWiki/CGI.pm
+++ b/IkiWiki/CGI.pm
@@ -277,8 +277,9 @@ sub cgi_prefs ($$) {
                return;
        }
        elsif ($form->submitted eq 'Save Preferences' && $form->validate) {
-               if (defined $form->field('email')) {
-                       userinfo_set($user_name, 'email', $form->field('email')) ||
+               my $email = $form->field('email');
+               if (defined $email) {
+                       userinfo_set($user_name, 'email', $email) ||
                                error("failed to set email");
                }
 
@@ -460,6 +461,9 @@ sub cgi (;$$) {
 sub cgierror ($) {
        my $message=shift;
 
+       eval q{use HTML::Entities};
+       $message = encode_entities($message);
+
        print "Content-type: text/html\n\n";
        print cgitemplate(undef, gettext("Error"),
                "<p class=\"error\">".gettext("Error").": $message</p>");