osm: Escape name parameter. Closes: #731797

diff --git a/IkiWiki/Plugin/osm.pm b/IkiWiki/Plugin/osm.pm
index b8255bb135f7c3c868dad302719970f610f3723b..472e26945a75575215218294c2a01cc68748bbf3 100644 (file)
--- a/IkiWiki/Plugin/osm.pm
+++ b/IkiWiki/Plugin/osm.pm
@@ -589,6 +589,7 @@ sub map_setup_code($;@) {
        }
         $options{'layers'} = $config{osm_layers};
 
+       $name=~s/'//g; # $name comes from user input
        return "mapsetup('mapdiv-$name', " . to_json(\%options) . ");";
 }
 

diff --git a/debian/changelog b/debian/changelog
index 7eeec77f9ee0875782057b6e7ccfbb0eb98ed8d9..64427e34f1f0e559438a01b9bd9a606bbc060706 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -2,6 +2,7 @@ ikiwiki (3.20140103) UNRELEASED; urgency=medium
 
   * inline: Allow overriding the title of the feed. Closes: #735123
     Thanks, Christophe Rhodes
+  * osm: Escape name parameter. Closes: #731797
 
  -- Joey Hess <joeyh@debian.org>  Mon, 13 Jan 2014 17:06:01 -0400