passwordauth: avoid userinfo forgery via repeated email parameter

[git.ikiwiki.info.git] / IkiWiki / Plugin / cvs.pm

diff --git a/IkiWiki/Plugin/cvs.pm b/IkiWiki/Plugin/cvs.pm
index 0a6cbfaf6358f7a53014260f71c69ae5820641dc..788f5116786f291d1543944c55522b6a758439e7 100644 (file)
--- a/IkiWiki/Plugin/cvs.pm
+++ b/IkiWiki/Plugin/cvs.pm
@@ -33,6 +33,7 @@ use warnings;
 use strict;
 use IkiWiki;
 
 use strict;
 use IkiWiki;
 

+use URI::Escape q{uri_escape_utf8};

 use File::chdir;
 
 
 use File::chdir;
 
 


@@ -315,7 +316,8 @@ sub rcs_recentchanges ($) {
                        $oldrev =~ s/INITIAL/0/;
                        $newrev =~ s/\(DEAD\)//;
                        my $diffurl = defined $config{diffurl} ? $config{diffurl} : "";
                        $oldrev =~ s/INITIAL/0/;
                        $newrev =~ s/\(DEAD\)//;
                        my $diffurl = defined $config{diffurl} ? $config{diffurl} : "";

-                       $diffurl=~s/\[\[file\]\]/$page/g;
+                       my $epage = uri_escape_utf8($page);
+                       $diffurl=~s/\[\[file\]\]/$epage/g;

                        $diffurl=~s/\[\[r1\]\]/$oldrev/g;
                        $diffurl=~s/\[\[r2\]\]/$newrev/g;
                        unshift @pages, {
                        $diffurl=~s/\[\[r1\]\]/$oldrev/g;
                        $diffurl=~s/\[\[r2\]\]/$newrev/g;
                        unshift @pages, {