passwordauth: avoid userinfo forgery via repeated email parameter

[git.ikiwiki.info.git] / IkiWiki / Plugin / tla.pm

diff --git a/IkiWiki/Plugin/tla.pm b/IkiWiki/Plugin/tla.pm
index 80c015e3cff881b8c59bd985647a73ae93bb6ca4..11be248e8da9d90fe050da1ad57f643a7ae0cdf1 100644 (file)
--- a/IkiWiki/Plugin/tla.pm
+++ b/IkiWiki/Plugin/tla.pm
@@ -4,6 +4,7 @@ package IkiWiki::Plugin::tla;
 use warnings;
 use strict;
 use IkiWiki;
+use URI::Escape q{uri_escape_utf8};
 
 sub import {
        hook(type => "checkconfig", id => "tla", call => \&checkconfig);
@@ -98,19 +99,23 @@ sub rcs_prepedit ($) {
        }
 }
 
-sub rcs_commit ($$$;$$$) {
-       my $file=shift;
-       my $message=shift;
-       my $rcstoken=shift;
-       my $user=shift;
-       my $ipaddr=shift;
-       my $emailuser=shift;
-
-       if (defined $user) {
-               $message="web commit by $user".(length $message ? ": $message" : "");
-       }
-       elsif (defined $ipaddr) {
-               $message="web commit from $ipaddr".(length $message ? ": $message" : "");
+sub rcs_commit (@) {
+       my %params=@_;
+
+       my ($file, $message, $rcstoken)=
+               ($params{file}, $params{message}, $params{token});
+
+       if (defined $params{session}) {
+               if (defined $params{session}->param("name")) {
+                       $message="web commit by ".
+                               $params{session}->param("name").
+                               (length $message ? ": $message" : "");
+               }
+               elsif (defined $params{session}->remote_addr()) {
+                       $message="web commit from ".
+                               $params{session}->remote_addr().
+                               (length $message ? ": $message" : "");
+               }
        }
 
        if (-d "$config{srcdir}/{arch}") {
@@ -140,10 +145,10 @@ sub rcs_commit ($$$;$$$) {
        return undef # success
 }
 
-sub rcs_commit_staged ($$$;$) {
+sub rcs_commit_staged (@) {
        # Commits all staged changes. Changes can be staged using rcs_add,
        # rcs_remove, and rcs_rename.
-       my ($message, $user, $ipaddr, $emailuser)=@_;
+       my %params=@_;
        
        error("rcs_commit_staged not implemented for tla"); # TODO
 }
@@ -220,7 +225,8 @@ sub rcs_recentchanges ($) {
 
                foreach my $file (@paths) {
                        my $diffurl=defined $config{diffurl} ? $config{diffurl} : "";
-                       $diffurl=~s/\[\[file\]\]/$file/g;
+                       my $efile = uri_escape_utf8($file);
+                       $diffurl=~s/\[\[file\]\]/$efile/g;
                        $diffurl=~s/\[\[rev\]\]/$change/g;
                        push @pages, {
                                page => pagename($file),