summaryrefslogtreecommitdiff
path: root/doc
diff options
context:
space:
mode:
Diffstat (limited to 'doc')
-rw-r--r--doc/bugs/404_when_cancel_create_page.mdwn11
1 files changed, 9 insertions, 2 deletions
diff --git a/doc/bugs/404_when_cancel_create_page.mdwn b/doc/bugs/404_when_cancel_create_page.mdwn
index b802de787..091254cb5 100644
--- a/doc/bugs/404_when_cancel_create_page.mdwn
+++ b/doc/bugs/404_when_cancel_create_page.mdwn
@@ -25,7 +25,9 @@ if it is known.
}
elsif ($form->submitted eq "Preview") {
-
+> I think you mean to use `$newfile`? I've applied a modieid version
+> that also deal with creating a new page with no defined $from location.
+> [[bugs/done]] --[[Joey]]
[P.S. just above that is
@@ -43,4 +45,9 @@ is there aren't going to be many possible extensions. Something like `/(.\w+)+/`
(groups of dot separated alpha-num chars if my perl-foo isn't failing me). You could
at least exclude `/` and `..`. I'm happy to turn this in to a patch if you agree.]
-
+> The reason it's safe to use possibly_foolish_untaint here is because
+> of the check for $hooks{htmlize}{$type}. This limits it to types
+> that have a registered htmlize hook (mdwn, etc), and not whatever random
+> garbage an attacker might try to put in. If it wasn't for that check,
+> using possibly_foolish_untaint there would be _very_ foolish indeed..
+> --[[Joey]]