close a possible XSS hole

[git.ikiwiki.info.git] / IkiWiki / CGI.pm

diff --git a/IkiWiki/CGI.pm b/IkiWiki/CGI.pm
index 7d4ba146fc9de3eb2e8ca08fb7b4d100a29c6bda..6e1efbd69927f1199b0af6ccee45285d8ef7ea81 100644 (file)
--- a/IkiWiki/CGI.pm
+++ b/IkiWiki/CGI.pm
@@ -9,6 +9,18 @@ use Encode;
 
 package IkiWiki;
 
+sub printheader ($) { #{{{
+       my $session=shift;
+       
+       if ($config{sslcookie}) {
+               print $session->header(-charset => 'utf-8',
+                       -cookie => $session->cookie(-secure => 1));
+       } else {
+               print $session->header(-charset => 'utf-8');
+       }
+
+} #}}}
+
 sub redirect ($$) { #{{{
        my $q=shift;
        my $url=shift;
@@ -64,15 +76,29 @@ sub cgi_recentchanges ($) { #{{{
        eval q{use Memoize};
        memoize("htmllink");
 
+       eval q{use Time::Duration};
+
+       my $changelog=[rcs_recentchanges(100)];
+       foreach my $change (@$changelog) {
+               $change->{when} = concise(ago($change->{when}));
+               $change->{user} = htmllink("", "", $change->{user}, 1);
+               $change->{pages} = [
+                       map {
+                               $_->{link} = htmllink("", "", $_->{page}, 1);
+                               $_;
+                       } @{$change->{pages}}
+               ];
+       }
+
        my $template=template("recentchanges.tmpl"); 
        $template->param(
                title => "RecentChanges",
                indexlink => indexlink(),
                wikiname => $config{wikiname},
-               changelog => [rcs_recentchanges(100)],
+               changelog => $changelog,
                baseurl => baseurl(),
        );
-       print $q->header(-charset=>'utf-8'), $template->output;
+       print $q->header(-charset => 'utf-8'), $template->output;
 } #}}}
 
 sub cgi_signin ($$) { #{{{
@@ -204,7 +230,7 @@ sub cgi_signin ($$) { #{{{
                                $form->field(name => "confirm_password", type => "hidden");
                                $form->field(name => "email", type => "hidden");
                                $form->text("Registration successful. Now you can Login.");
-                               print $session->header(-charset=>'utf-8');
+                               printheader($session);
                                print misctemplate($form->title, $form->render(submit => ["Login"]));
                        }
                        else {
@@ -232,12 +258,12 @@ sub cgi_signin ($$) { #{{{
                        
                        $form->text("Your password has been emailed to you.");
                        $form->field(name => "name", required => 0);
-                       print $session->header(-charset=>'utf-8');
+                       printheader($session);
                        print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
                }
        }
        else {
-               print $session->header(-charset=>'utf-8');
+               printheader($session);
                print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
        }
 } #}}}
@@ -314,7 +340,7 @@ sub cgi_prefs ($$) { #{{{
                $form->text("Preferences saved.");
        }
        
-       print $session->header(-charset=>'utf-8');
+       printheader($session);
        print misctemplate($form->title, $form->render(submit => \@buttons));
 } #}}}
 
@@ -411,8 +437,12 @@ sub cgi_editpage ($$) { #{{{
                                value => $content, force => 1);
                $form->field(name => "comments",
                                value => $comments, force => 1);
+               $config{rss}=0; # avoid preview writing an rss feed!
                $form->tmpl_param("page_preview",
-                       htmlize($type, linkify($page, "", filter($page, $content))));
+                       htmlize($page, $type,
+                       linkify($page, "",
+                       preprocess($page, $page,
+                       filter($page, $content)))));
        }
        else {
                $form->tmpl_param("page_preview", "");
@@ -592,7 +622,7 @@ sub cgi () { #{{{
        umask($oldmask);
        
        # Everything below this point needs the user to be signed in.
-       if ((! $config{anonok} &&
+       if (((! $config{anonok} || $do eq 'prefs') &&
             (! defined $session->param("name") ||
             ! userinfo_get($session->param("name"), "regdate"))) || $do eq 'signin') {
                cgi_signin($q, $session);