summaryrefslogtreecommitdiff
path: root/doc/plugins
diff options
context:
space:
mode:
authorjoey <joey@0fa5a96a-9a0e-0410-b3b2-a0fd24251071>2007-03-21 18:52:56 +0000
committerjoey <joey@0fa5a96a-9a0e-0410-b3b2-a0fd24251071>2007-03-21 18:52:56 +0000
commitc8b4ba354f82fbbcebbbfca65b40a047f9920525 (patch)
tree6dd5bd85031e42da9a3c65d1c5c3f9bfacfdfcda /doc/plugins
parent829d097dc52b6a8f50297406affc67fbc08dccb7 (diff)
* Fix a security hole that allowed insertion of unsafe content via the meta
plugins's support for inserting html link and meta tags. Now such content is passed through the htmlscrubber like everything else. * Unfortunatly, that means that some valid uses of those tags are no longer usable, and special case methods needed to be added for including stylesheets, and for doing openid delegation. If you use either of these in your wiki, it will need to be modified. See the meta plugin docs for details.
Diffstat (limited to 'doc/plugins')
-rw-r--r--doc/plugins/meta.mdwn45
1 files changed, 32 insertions, 13 deletions
diff --git a/doc/plugins/meta.mdwn b/doc/plugins/meta.mdwn
index 5c3098e56..cebe11f56 100644
--- a/doc/plugins/meta.mdwn
+++ b/doc/plugins/meta.mdwn
@@ -10,21 +10,25 @@ Enter the metadata as follows:
The first form sets a given field to a given value, while the second form
also specifies some additional sub-parameters.
+The field values are treated as HTML entity-escaped text, so you can include
+a quote in the text by writing `&quot;` and so on.
+
You can use any field names you like, but here are some predefined ones:
* link
- Specifies a link to another page. This is used to generate a html
- &lt;link&gt; tag, and also as a way to make the wiki treat one page as
- linking to another without displaying a user-visible link. The latter
- can be useful when using links to categorise pages. A html link tag
- would look like this:
+ Specifies a link to another page. This can be used as a way to make the
+ wiki treat one page as linking to another without displaying a user-visible
+ [[WikiLink]]:
+
+ \[[meta link=otherpage]]
- \[[meta link="foo.css" rel="stylesheet" type="text/css"]]
+ It can also be used to insert a html &lt;link&gt; tag. For example:
- A non-user-visible [[WikiLink]] would instead look like this:
+ \[[meta link="http://joeyh.myopenid.com/" rel="openid.delegate"]]
- \[[meta link=otherpage]]
+ However, this latter syntax won't be allowed if the [[htmlscrubber]] is
+ enabled, since it can be used to insert unsafe content.
* title
@@ -53,9 +57,24 @@ You can use any field names you like, but here are some predefined ones:
Specifies the creation date of the page. The date can be entered in
nearly any format, since it's parsed by [[cpan TimeDate]].
-If the field is not treated specially (as the link and title fields are),
-the metadata will be written to the generated html page as a &lt;meta&gt;
-header.
+* stylesheet
-The field value is treated as HTML entity-escaped text, so you can include
-a quote in the text by writing `&quot;` and so on.
+ Adds a stylesheet to a page. The stylesheet is treated as a wiki link to
+ a `.css` file in the wiki, so it cannot be used to add links to external
+ stylesheets. Example:
+
+ \[[meta stylesheet=somestyle rel="alternate stylesheet"
+ title="somestyle"]]
+
+* openid
+
+ Adds html &lt;link&gt; tags to perform OpenID delegation to an external
+ OpenID server. This lets you use an ikiwiki page as your OpenID. Example:
+
+ \\[[meta openid="http://joeyh.myopenid.com/"
+ server="http://www.myopenid.com/server"]]
+
+If the field is not one of the above predefined fields, the metadata will be
+written to the generated html page as a &lt;meta&gt; header. However, this
+won't be allowed if the [[htmlscrubber]] is enabled, since it can be used to
+insert unsafe content.