From: Joey Hess <joey@gnu.kitenet.net>
Date: Sat, 8 Aug 2009 16:27:48 +0000 (-0400)
Subject: verify page name is sane
X-Git-Tag: 3.15~16
X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/commitdiff_plain/8f6e0212fdbf3de286e504ed2802111bf7864abe?ds=sidebyside

verify page name is sane

paranoia; I was thinking about XSS attacks specificaly
---

diff --git a/IkiWiki/Plugin/getsource.pm b/IkiWiki/Plugin/getsource.pm
index 91c4cc1c9..ae9ea3cc7 100644
--- a/IkiWiki/Plugin/getsource.pm
+++ b/IkiWiki/Plugin/getsource.pm
@@ -42,13 +42,17 @@ sub pagetemplate (@) {
 sub cgi_getsource ($) {
 	my $cgi=shift;
 
-	return unless (defined $cgi->param('do') &&
-					$cgi->param("do") eq "getsource");
+	return unless defined $cgi->param('do') &&
+	              $cgi->param("do") eq "getsource";
 
 	IkiWiki::decode_cgi_utf8($cgi);
 
 	my $page=$cgi->param('page');
 
+	if (! defined $page || $page !~ /$config{wiki_file_regexp}/) {
+		error("invalid page parameter");
+	}
+
 	# For %pagesources.
 	IkiWiki::loadindex();