From 09d4e9d6bb7a049b0721ffbf7dc6e64bee4404cc Mon Sep 17 00:00:00 2001 From: Joey Hess Date: Mon, 5 Apr 2010 16:34:49 -0400 Subject: comments: Fix missing entity encoding in title. The meta title data set by comments needs to be encoded the same way that meta encodes it. (NB The security implications of the missing encoding are small.) Note that meta's encoding of title, description, and guid data, and not other data, is probably a special case that should be removed. Instead, these values should be encoded when used. I have avoided doing so here because that would mean forcing a wiki rebuild on upgrade to have the data consitently encoded. --- IkiWiki/Plugin/comments.pm | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'IkiWiki') diff --git a/IkiWiki/Plugin/comments.pm b/IkiWiki/Plugin/comments.pm index 98786f432..460341710 100644 --- a/IkiWiki/Plugin/comments.pm +++ b/IkiWiki/Plugin/comments.pm @@ -221,7 +221,9 @@ sub preprocess { } if (defined $params{subject}) { - $pagestate{$page}{meta}{title} = $params{subject}; + # encode title the same way meta does + eval q{use HTML::Entities}; + $pagestate{$page}{meta}{title} = HTML::Entities::encode_numeric(decode_entities($params{subject})); } if ($params{page} =~ m/\/\Q$config{comments_pagename}\E\d+_/) { -- cgit v1.2.3