passwordauth: avoid userinfo forgery via repeated email parameter

[git.ikiwiki.info.git] / IkiWiki / Plugin / editpage.pm

diff --git a/IkiWiki/Plugin/editpage.pm b/IkiWiki/Plugin/editpage.pm
index d3c6959354eeebf550d199870cbe7a1c5d1a818c..d15607990db2412b8a14f281864f82f98b3cac7f 100644 (file)
--- a/IkiWiki/Plugin/editpage.pm
+++ b/IkiWiki/Plugin/editpage.pm
@@ -64,7 +64,8 @@ sub cgi_editpage ($$) {
 
        decode_cgi_utf8($q);
 
-       my @fields=qw(do rcsinfo subpage from page type editcontent editmessage);
+       my @fields=qw(do rcsinfo subpage from page type editcontent
+               editmessage subscribe);
        my @buttons=("Save Page", "Preview", "Cancel");
        eval q{use CGI::FormBuilder};
        error($@) if $@;
@@ -157,6 +158,17 @@ sub cgi_editpage ($$) {
                        noimageinline => 1,
                        linktext => "FormattingHelp"));
        
+       my $cansubscribe=IkiWiki::Plugin::notifyemail->can("subscribe")
+               && IkiWiki::Plugin::comments->can("import")
+               && defined $session->param('name');
+       if ($cansubscribe) {
+               $form->field(name => "subscribe", type => "checkbox",
+                       options => [gettext("email comments to me")]);
+       }
+       else {
+               $form->field(name => "subscribe", type => 'hidden');
+       }
+       
        my $previewing=0;
        if ($form->submitted eq "Cancel") {
                if ($form->field("do") eq "create" && defined $from) {
@@ -448,6 +460,12 @@ sub cgi_editpage ($$) {
                        # caches and get the most recent version of the page.
                        redirect($q, $baseurl."?updated");
                }
+
+               if ($cansubscribe && length $form->field("subscribe")) {
+                       my $subspec="comment($page)";
+                       IkiWiki::Plugin::notifyemail::subscribe(
+                               $session->param('name'), $subspec);
+               }
        }
 
        exit;