passwordauth: avoid userinfo forgery via repeated email parameter

[git.ikiwiki.info.git] / IkiWiki / Plugin / poll.pm

diff --git a/IkiWiki/Plugin/poll.pm b/IkiWiki/Plugin/poll.pm
index 32cb5c48f2ca8156c44a60ff5f1daa2852ffc759..2773486a6c69560fdd0a2236607b800dc88b15e6 100644 (file)
--- a/IkiWiki/Plugin/poll.pm
+++ b/IkiWiki/Plugin/poll.pm
@@ -3,19 +3,29 @@ package IkiWiki::Plugin::poll;
 
 use warnings;
 use strict;
 
 use warnings;
 use strict;

-use IkiWiki 2.00;
+use IkiWiki 3.00;

 use Encode;
 
 use Encode;
 

-sub import { #{{{
+sub import {
+       hook(type => "getsetup", id => "poll", call => \&getsetup);

        hook(type => "preprocess", id => "poll", call => \&preprocess);
        hook(type => "sessioncgi", id => "poll", call => \&sessioncgi);
        hook(type => "preprocess", id => "poll", call => \&preprocess);
        hook(type => "sessioncgi", id => "poll", call => \&sessioncgi);

-} # }}}
+}
+
+sub getsetup () {
+       return 
+               plugin => {
+                       safe => 1,
+                       rebuild => undef,
+                       section => "widget",
+               },
+}

 
 my %pagenum;
 
 my %pagenum;

-sub preprocess (@) { #{{{
+sub preprocess (@) {

        my %params=(open => "yes", total => "yes", percent => "yes", @_);
 
        my %params=(open => "yes", total => "yes", percent => "yes", @_);
 

-       my $open=IkiWIki::yesno($params{open});
+       my $open=IkiWiki::yesno($params{open});

        my $showtotal=IkiWiki::yesno($params{total});
        my $showpercent=IkiWiki::yesno($params{percent});
        $pagenum{$params{page}}++;
        my $showtotal=IkiWiki::yesno($params{total});
        my $showpercent=IkiWiki::yesno($params{percent});
        $pagenum{$params{page}}++;


@@ -42,7 +52,7 @@ sub preprocess (@) { #{{{
        foreach my $choice (@choices) {
                if ($open && exists $config{cgiurl}) {
                        # use POST to avoid robots
        foreach my $choice (@choices) {
                if ($open && exists $config{cgiurl}) {
                        # use POST to avoid robots

-                       $ret.="<form method=\"POST\" action=\"$config{cgiurl}\">\n";
+                       $ret.="<form method=\"POST\" action=\"".IkiWiki::cgiurl()."\">\n";

                }
                my $percent=$total > 0 ? int($choices{$choice} / $total * 100) : 0;
                $ret.="<p>\n";
                }
                my $percent=$total > 0 ? int($choices{$choice} / $total * 100) : 0;
                $ret.="<p>\n";


@@ -68,9 +78,9 @@ sub preprocess (@) { #{{{
                $ret.="<span>".gettext("Total votes:")." $total</span>\n";
        }
        return "<div class=poll>$ret</div>";
                $ret.="<span>".gettext("Total votes:")." $total</span>\n";
        }
        return "<div class=poll>$ret</div>";

-} # }}}
+}

 
 

-sub sessioncgi ($$) { #{{{
+sub sessioncgi ($$) {

        my $cgi=shift;
        my $session=shift;
        if (defined $cgi->param('do') && $cgi->param('do') eq "poll") {
        my $cgi=shift;
        my $session=shift;
        if (defined $cgi->param('do') && $cgi->param('do') eq "poll") {


@@ -93,7 +103,7 @@ sub sessioncgi ($$) { #{{{
                my $oldchoice=$session->param($choice_param);
                if (defined $oldchoice && $oldchoice eq $choice) {
                        # Same vote; no-op.
                my $oldchoice=$session->param($choice_param);
                if (defined $oldchoice && $oldchoice eq $choice) {
                        # Same vote; no-op.

-                       IkiWiki::redirect($cgi, "$config{url}/".htmlpage($page));
+                       IkiWiki::redirect($cgi, urlto($page));

                        exit;
                }
 
                        exit;
                }
 


@@ -124,9 +134,12 @@ sub sessioncgi ($$) { #{{{
                $oldchoice=$session->param($choice_param);
                if ($config{rcs}) {
                        IkiWiki::disable_commit_hook();
                $oldchoice=$session->param($choice_param);
                if ($config{rcs}) {
                        IkiWiki::disable_commit_hook();

-                       IkiWiki::rcs_commit($pagesources{$page}, "poll vote ($choice)",
-                               IkiWiki::rcs_prepedit($pagesources{$page}),
-                               $session->param("name"), $ENV{REMOTE_ADDR});
+                       IkiWiki::rcs_commit(
+                               file => $pagesources{$page},
+                               message => "poll vote ($choice)",
+                               token => IkiWiki::rcs_prepedit($pagesources{$page}),
+                               session => $session,
+                       );

                        IkiWiki::enable_commit_hook();
                        IkiWiki::rcs_update();
                }
                        IkiWiki::enable_commit_hook();
                        IkiWiki::rcs_update();
                }


@@ -140,9 +153,9 @@ sub sessioncgi ($$) { #{{{
                error($@) if $@;
                my $cookie = CGI::Cookie->new(-name=> $session->name, -value=> $session->id);
                print $cgi->redirect(-cookie => $cookie,
                error($@) if $@;
                my $cookie = CGI::Cookie->new(-name=> $session->name, -value=> $session->id);
                print $cgi->redirect(-cookie => $cookie,

-                       -url => "$config{url}/".htmlpage($page));
+                       -url => urlto($page));

                exit;
        }
                exit;
        }

-} #}}}
+}

 
 1
 
 1