* Fix a security hole that allowed insertion of unsafe content via the meta

  plugins's support for inserting html link and meta tags. Now such content
  is passed through the htmlscrubber like everything else.
* Unfortunatly, that means that some valid uses of those tags are no longer
  usable, and special case methods needed to be added for including
  stylesheets, and for doing openid delegation. If you use either of these
  in your wiki, it will need to be modified. See the meta plugin docs
  for details.

1 files changed, 32 insertions, 13 deletions

diff --git a/doc/plugins/meta.mdwn b/doc/plugins/meta.mdwn
index 5c3098e56..cebe11f56 100644
--- a/doc/plugins/meta.mdwn
+++ b/doc/plugins/meta.mdwn
@@ -10,21 +10,25 @@ Enter the metadata as follows:
 The first form sets a given field to a given value, while the second form
 also specifies some additional sub-parameters.
 
+The field values are treated as HTML entity-escaped text, so you can include
+a quote in the text by writing `"` and so on.
+
 You can use any field names you like, but here are some predefined ones:
 
 * link
 
-  Specifies a link to another page. This is used to generate a html
-  <link> tag, and also as a way to make the wiki treat one page as
-  linking to another without displaying a user-visible link. The latter 
-  can be useful when using links to categorise pages. A html link tag
-  would look like this:
+  Specifies a link to another page. This can be used as a way to make the
+  wiki treat one page as linking to another without displaying a user-visible
+  [[WikiLink]]:
+
+	\[[meta link=otherpage]]
 
-	\[[meta link="foo.css" rel="stylesheet" type="text/css"]]
+  It can also be used to insert a html <link> tag. For example:
 
-  A non-user-visible [[WikiLink]] would instead look like this:
+  	\[[meta link="http://joeyh.myopenid.com/" rel="openid.delegate"]]
 
-	\[[meta link=otherpage]]
+  However, this latter syntax won't be allowed if the [[htmlscrubber]] is
+  enabled, since it can be used to insert unsafe content.
 
 * title
 
@@ -53,9 +57,24 @@ You can use any field names you like, but here are some predefined ones:
   Specifies the creation date of the page. The date can be entered in
   nearly any format, since it's parsed by [[cpan TimeDate]].
 
-If the field is not treated specially (as the link and title fields are),
-the metadata will be written to the generated html page as a <meta>
-header.
+* stylesheet
 
-The field value is treated as HTML entity-escaped text, so you can include
-a quote in the text by writing `"` and so on.
+  Adds a stylesheet to a page. The stylesheet is treated as a wiki link to
+  a `.css` file in the wiki, so it cannot be used to add links to external
+  stylesheets. Example:
+
+	\[[meta stylesheet=somestyle rel="alternate stylesheet"
+	title="somestyle"]]
+
+* openid
+
+  Adds html <link> tags to perform OpenID delegation to an external
+  OpenID server. This lets you use an ikiwiki page as your OpenID. Example:
+
+  	\\[[meta openid="http://joeyh.myopenid.com/"
+	server="http://www.myopenid.com/server"]]
+
+If the field is not one of the above predefined fields, the metadata will be
+written to the generated html page as a <meta> header. However, this
+won't be allowed if the [[htmlscrubber]] is enabled, since it can be used to
+insert unsafe content.