* htmlscrubber security fix: Block javascript in uris.

[git.ikiwiki.info.git] / IkiWiki / Plugin / shortcut.pm

diff --git a/IkiWiki/Plugin/shortcut.pm b/IkiWiki/Plugin/shortcut.pm
index ca527ce3ca533a12ed4dc2bb3c1ae73a148383db..fb096ecbd8677d183634bfae095ec40895bfbf2c 100644 (file)
--- a/IkiWiki/Plugin/shortcut.pm
+++ b/IkiWiki/Plugin/shortcut.pm
@@ -13,8 +13,11 @@ sub import { #{{{
 sub checkconfig () { #{{{
        # Preprocess the shortcuts page to get all the available shortcuts
        # defined before other pages are rendered.
-       IkiWiki::preprocess("shortcuts", "shortcuts",
-               readfile(srcfile("shortcuts.mdwn")));
+       my $srcfile=eval {srcfile("shortcuts.mdwn")};
+       if (! defined $srcfile) {
+               error(gettext("shortcut plugin will not work without a shortcuts.mdwn"));
+       }
+       IkiWiki::preprocess("shortcuts", "shortcuts", readfile($srcfile));
 } # }}}
 
 sub preprocess_shortcut (@) { #{{{
@@ -53,6 +56,10 @@ sub shortcut_expand ($$@) { #{{{
        my $text=join(" ", @params);
        my $encoded_text=$text;
        $encoded_text=~s/([^A-Za-z0-9])/sprintf("%%%02X", ord($1))/seg;
+       
+       $url=~s{\%([sS])}{
+               $1 eq 's' ? $encoded_text : $text
+       }eg;
 
        $text=~s/_/ /g;
        if (defined $desc) {
@@ -62,7 +69,6 @@ sub shortcut_expand ($$@) { #{{{
                $desc=$text;
        }
 
-       $url=~s/\%s/$encoded_text/g;
        return "<a href=\"$url\">$desc</a>";
 } #}}}