X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/0afcec734622811b8910d3df5d102df58d429a51..66e894c8771c5a5dfbd4cb92f826d4d397b2256f:/IkiWiki/Plugin/getsource.pm?ds=sidebyside diff --git a/IkiWiki/Plugin/getsource.pm b/IkiWiki/Plugin/getsource.pm index 6a208f1e7..ae9ea3cc7 100644 --- a/IkiWiki/Plugin/getsource.pm +++ b/IkiWiki/Plugin/getsource.pm @@ -42,20 +42,21 @@ sub pagetemplate (@) { sub cgi_getsource ($) { my $cgi=shift; - # Note: we use sessioncgi rather than just cgi - # because we need $IkiWiki::pagesources{} to be - # populated. - - return unless (defined $cgi->param('do') && - $cgi->param("do") eq "getsource"); + return unless defined $cgi->param('do') && + $cgi->param("do") eq "getsource"; IkiWiki::decode_cgi_utf8($cgi); my $page=$cgi->param('page'); + if (! defined $page || $page !~ /$config{wiki_file_regexp}/) { + error("invalid page parameter"); + } + + # For %pagesources. IkiWiki::loadindex(); - if (! exists $IkiWiki::pagesources{$page}) { + if (! exists $pagesources{$page}) { IkiWiki::cgi_custom_failure( $cgi->header(-status => "404 Not Found"), IkiWiki::misctemplate(gettext("missing page"), @@ -66,18 +67,25 @@ sub cgi_getsource ($) { exit; } - my $data = IkiWiki::readfile(IkiWiki::srcfile($IkiWiki::pagesources{$page})); + if (! defined pagetype($pagesources{$page})) { + IkiWiki::cgi_custom_failure( + $cgi->header(-status => "403 Forbidden"), + IkiWiki::misctemplate(gettext("not a page"), + "
". + sprintf(gettext("%s is an attachment, not a page."), + htmllink("", "", $page)). + "
")); + exit; + } if (! $config{getsource_mimetype}) { $config{getsource_mimetype} = "text/plain; charset=utf-8"; } print "Content-Type: $config{getsource_mimetype}\r\n"; - print ("\r\n"); + print readfile(srcfile($pagesources{$page})); - print $data; - exit 0; }