comments: Fix XSS security hole due to missing validation of page name. CVE-2011...

[git.ikiwiki.info.git] / IkiWiki / Plugin / comments.pm

diff --git a/IkiWiki/Plugin/comments.pm b/IkiWiki/Plugin/comments.pm
index 851f4862eb3a5a39bb0afb387b35dfc60262024d..6bacd26c7832ae75ecd5b6d4dea97b4a6c244453 100644 (file)
--- a/IkiWiki/Plugin/comments.pm
+++ b/IkiWiki/Plugin/comments.pm
@@ -364,8 +364,8 @@ sub editcomment ($$) {
        }
 
        # The untaint is OK (as in editpage) because we're about to pass
-       # it to file_pruned anyway
-       my $page = $form->field('page');
+       # it to file_pruned and wiki_file_regexp anyway.
+       my $page = $form->field('page')=~/$config{wiki_file_regexp}/;
        $page = IkiWiki::possibly_foolish_untaint($page);
        if (! defined $page || ! length $page ||
                IkiWiki::file_pruned($page)) {
@@ -727,6 +727,10 @@ sub previewcomment ($$$) {
        my $page=shift;
        my $time=shift;
 
+       # Previewing a comment should implicitly enable comment posting mode.
+       my $oldpostcomment=$postcomment;
+       $postcomment=1;
+
        my $preview = IkiWiki::htmlize($location, $page, '_comment',
                        IkiWiki::linkify($location, $page,
                        IkiWiki::preprocess($location, $page,
@@ -745,6 +749,8 @@ sub previewcomment ($$$) {
 
        $template->param(have_actions => 0);
 
+       $postcomment=$oldpostcomment;
+
        return $template->output;
 }
 
@@ -941,14 +947,16 @@ sub match_comment ($$;@) {
        my $page = shift;
        my $glob = shift;
 
-       # To see if it's a comment, check the source file type.
-       # Deal with comments that were just deleted.
-       my $source=exists $IkiWiki::pagesources{$page} ?
-               $IkiWiki::pagesources{$page} :
-               $IkiWiki::delpagesources{$page};
-       my $type=defined $source ? IkiWiki::pagetype($source) : undef;
-       if (! defined $type || $type ne "_comment") {
-               return IkiWiki::FailReason->new("$page is not a comment");
+       if (! $postcomment) {
+               # To see if it's a comment, check the source file type.
+               # Deal with comments that were just deleted.
+               my $source=exists $IkiWiki::pagesources{$page} ?
+                       $IkiWiki::pagesources{$page} :
+                       $IkiWiki::delpagesources{$page};
+               my $type=defined $source ? IkiWiki::pagetype($source) : undef;
+               if (! defined $type || $type ne "_comment") {
+                       return IkiWiki::FailReason->new("$page is not a comment");
+               }
        }
 
        return match_glob($page, "$glob/*", internal => 1, @_);