move security to discussion

[git.ikiwiki.info.git] / IkiWiki / Plugin / comments.pm

diff --git a/IkiWiki/Plugin/comments.pm b/IkiWiki/Plugin/comments.pm
index 3cdffe856132160df72045d275d6de6d7666631c..98f9f8b3de8ec224b0fa23a033b476e852a700a9 100644 (file)
--- a/IkiWiki/Plugin/comments.pm
+++ b/IkiWiki/Plugin/comments.pm
@@ -224,7 +224,7 @@ sub preprocess {
 
        if ($params{page} =~ m/\/(\Q$config{comments_pagename}\E\d+)$/) {
                $pagestate{$page}{meta}{permalink} = urlto(IkiWiki::dirname($params{page}), undef, 1).
-                       "#".$params{page};
+                       "#".page_to_id($params{page});
        }
 
        eval q{use Date::Parse};
@@ -490,7 +490,8 @@ sub editcomment ($$) {
                # Jump to the new comment on the page.
                # The trailing question mark tries to avoid broken
                # caches and get the most recent version of the page.
-               IkiWiki::redirect($cgi, urlto($page, undef, 1)."?updated#$location");
+               IkiWiki::redirect($cgi, urlto($page, undef, 1).
+                       "?updated#".page_to_id($location));
 
        }
        else {
@@ -605,7 +606,8 @@ sub formbuilder_setup (@) {
        my %params=@_;
 
        my $form=$params{form};
-       if ($form->title eq "preferences") {
+       if ($form->title eq "preferences" &&
+           IkiWiki::is_admin($params{session}->param("name"))) {
                push @{$params{buttons}}, "Comment Moderation";
                if ($form->submitted && $form->submitted eq "Comment Moderation") {
                        commentmoderation($params{cgi}, $params{session});
@@ -671,7 +673,7 @@ sub previewcomment ($$$) {
 sub commentsshown ($) {
        my $page=shift;
 
-       return ! pagespec_match($page, "*/$config{comments_pagename}*",
+       return ! pagespec_match($page, "internal(*/$config{comments_pagename}*)",
                                location => $page) &&
               pagespec_match($page, $config{comments_pagespec},
                              location => $page);
@@ -758,6 +760,10 @@ sub pagetemplate (@) {
        if (!exists $commentstate{$page}) {
                return;
        }
+       
+       if ($template->query(name => 'commentid')) {
+               $template->param(commentid => page_to_id($page));
+       }
 
        if ($template->query(name => 'commentuser')) {
                $template->param(commentuser =>
@@ -807,6 +813,18 @@ sub unique_comment_location ($) {
        return $location;
 }
 
+sub page_to_id ($) {
+       # Converts a comment page name into a unique, legal html id
+       # addtibute value, that can be used as an anchor to link to the
+       # comment.
+       my $page=shift;
+
+       eval q{use Digest::MD5 'md5_hex'};
+       error($@) if $@;
+
+       return "comment-".md5_hex($page);
+}
+       
 package IkiWiki::PageSpec;
 
 sub match_postcomment ($$;@) {