passwordauth: avoid userinfo forgery via repeated email parameter

[git.ikiwiki.info.git] / IkiWiki / Plugin / bzr.pm

diff --git a/IkiWiki/Plugin/bzr.pm b/IkiWiki/Plugin/bzr.pm
index 3bc4ea8dd69b1d67329ec1db81bdd2e4ac9d19cf..72552abccaa96212c5f71d48cefcbb1b21e4498b 100644 (file)
--- a/IkiWiki/Plugin/bzr.pm
+++ b/IkiWiki/Plugin/bzr.pm
@@ -5,6 +5,7 @@ use warnings;
 use strict;
 use IkiWiki;
 use Encode;
+use URI::Escape q{uri_escape_utf8};
 use open qw{:utf8 :std};
 
 sub import {
@@ -242,8 +243,10 @@ sub rcs_recentchanges ($) {
                        # Skip source name in renames
                        $filename =~ s/^.* => //;
 
+                       my $efilename = uri_escape_utf8($filename);
+
                        my $diffurl = defined $config{'diffurl'} ? $config{'diffurl'} : "";
-                       $diffurl =~ s/\[\[file\]\]/$filename/go;
+                       $diffurl =~ s/\[\[file\]\]/$efilename/go;
                        $diffurl =~ s/\[\[file-id\]\]/$fileid/go;
                        $diffurl =~ s/\[\[r2\]\]/$info->{revno}/go;