From 12eb585353660d121e48d5796d35354b66c7e522 Mon Sep 17 00:00:00 2001
From: Joey Hess <joey@kodama.kitenet.net>
Date: Sat, 20 Sep 2008 22:48:22 -0400
Subject: add missing page name sanity check

---
 IkiWiki/Plugin/editpage.pm | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

(limited to 'IkiWiki/Plugin/editpage.pm')

diff --git a/IkiWiki/Plugin/editpage.pm b/IkiWiki/Plugin/editpage.pm
index bb21ed2be..68f43bf16 100644
--- a/IkiWiki/Plugin/editpage.pm
+++ b/IkiWiki/Plugin/editpage.pm
@@ -85,8 +85,9 @@ sub cgi_editpage ($$) { #{{{
 	});
 	decode_form_utf8($form);
 	
-	# This untaint is safe because we check file_pruned.
-	my $page=$form->field('page');
+	# This untaint is safe because we check file_pruned and
+	# wiki_file_regexp.
+	my ($page)=$form->field('page')=~/$config{wiki_file_regexp}/;
 	$page=possibly_foolish_untaint($page);
 	my $absolute=($page =~ s#^/+##);
 	if (! defined $page || ! length $page ||
-- 
cgit v1.2.3