meta: Security fix; don't allow alternative stylesheets to be added on pages where...

[git.ikiwiki.info.git] / IkiWiki / Plugin / openid.pm

diff --git a/IkiWiki/Plugin/openid.pm b/IkiWiki/Plugin/openid.pm
index 4727577f342587bc1e99fdc77c8afb1a42bdb91e..bd67384f21a91477239df3c48c598cf837ea09b6 100644 (file)
--- a/IkiWiki/Plugin/openid.pm
+++ b/IkiWiki/Plugin/openid.pm
@@ -77,14 +77,14 @@ sub openid_selector {
 
        my $template=IkiWiki::template("openid-selector.tmpl");
        $template->param(
 
        my $template=IkiWiki::template("openid-selector.tmpl");
        $template->param(

-               cgiurl => $config{cgiurl},
+               cgiurl => IkiWiki::cgiurl(),

                (defined $openid_error ? (openid_error => $openid_error) : ()),
                (defined $openid_url ? (openid_url => $openid_url) : ()),
                ($real_cgi_signin ? (nonopenidform => $real_cgi_signin->($q, $session, 1)) : ()),
        );
 
        IkiWiki::printheader($session);
                (defined $openid_error ? (openid_error => $openid_error) : ()),
                (defined $openid_url ? (openid_url => $openid_url) : ()),
                ($real_cgi_signin ? (nonopenidform => $real_cgi_signin->($q, $session, 1)) : ()),
        );
 
        IkiWiki::printheader($session);

-       print IkiWiki::misctemplate("signin", $template->output);
+       print IkiWiki::cgitemplate($q, "signin", $template->output);

        exit;
 }
 
        exit;
 }
 


@@ -148,7 +148,7 @@ sub validate ($$$;$) {
        }
 
        my $cgiurl=$config{openid_cgiurl};
        }
 
        my $cgiurl=$config{openid_cgiurl};

-       $cgiurl=$config{cgiurl} if ! defined $cgiurl;
+       $cgiurl=$q->url if ! defined $cgiurl;

 
        my $trust_root=$config{openid_realm};
        $trust_root=$cgiurl if ! defined $trust_root;
 
        my $trust_root=$config{openid_realm};
        $trust_root=$cgiurl if ! defined $trust_root;


@@ -175,7 +175,7 @@ sub auth ($$) {
                        IkiWiki::redirect($q, $setup_url);
                }
                elsif ($csr->user_cancel) {
                        IkiWiki::redirect($q, $setup_url);
                }
                elsif ($csr->user_cancel) {

-                       IkiWiki::redirect($q, $config{url});
+                       IkiWiki::redirect($q, IkiWiki::baseurl(undef));

                }
                elsif (my $vident = $csr->verified_identity) {
                        $session->param(name => $vident->url);
                }
                elsif (my $vident = $csr->verified_identity) {
                        $session->param(name => $vident->url);


@@ -211,9 +211,8 @@ sub auth ($$) {
                                }
                        }
                        if (defined $nickname) {
                                }
                        }
                        if (defined $nickname) {

-                               $nickname=~s/\s+/_/g;
-                               $nickname=~s/[^-_0-9[:alnum:]]+//g;
-                               $session->param(nickname => $nickname);
+                               $session->param(nickname =>
+                                       Encode::decode_utf8($nickname));

                        }
                }
                else {
                        }
                }
                else {


@@ -250,7 +249,7 @@ sub getobj ($$) {
        }
        
        my $cgiurl=$config{openid_cgiurl};
        }
        
        my $cgiurl=$config{openid_cgiurl};

-       $cgiurl=$config{cgiurl} if ! defined $cgiurl;
+       $cgiurl=$q->url if ! defined $cgiurl;

 
        return Net::OpenID::Consumer->new(
                ua => $ua,
 
        return Net::OpenID::Consumer->new(
                ua => $ua,