From 05124f9a86dadca50c693d57f8fc8398fb5d8be9 Mon Sep 17 00:00:00 2001
From: Joey Hess <joey@kodama.kitenet.net>
Date: Sun, 6 Jul 2008 15:52:04 -0400
Subject: editpage escaping fixes

* The editpage form now uses the raw page name, not the page title, in its
  'page' cgi parameter. Using the title was ambiguous and made it
  impossible to tell between some pages, like "foo/bar" and "foo__47__bar",
  sometimes causing the wrong page to be edited.
* This change means that some edit links need to be updated.
  Force a rebuild on upgrade to this version.
* Above change also allowed really fixing escaped slashes from the blogpost
  form.
---
 IkiWiki/CGI.pm             | 11 +++++------
 IkiWiki/Plugin/editdiff.pm |  2 +-
 IkiWiki/Plugin/inline.pm   |  8 ++++----
 IkiWiki/Render.pm          |  2 +-
 4 files changed, 11 insertions(+), 12 deletions(-)

(limited to 'IkiWiki')

diff --git a/IkiWiki/CGI.pm b/IkiWiki/CGI.pm
index 07e92322f..99cead64f 100644
--- a/IkiWiki/CGI.pm
+++ b/IkiWiki/CGI.pm
@@ -301,10 +301,9 @@ sub cgi_editpage ($$) { #{{{
 	});
 	decode_form_utf8($form);
 	
-	# This untaint is safe because titlepage removes any problematic
-	# characters.
+	# This untaint is safe because we check file_pruned.
 	my $page=$form->field('page');
-	$page=titlepage(possibly_foolish_untaint($page));
+	$page=possibly_foolish_untaint($page);
 	if (! defined $page || ! length $page ||
 	    file_pruned($page, $config{srcdir}) || $page=~/^\//) {
 		error("bad page name");
@@ -354,7 +353,7 @@ sub cgi_editpage ($$) { #{{{
 	$form->field(name => "from", type => 'hidden');
 	$form->field(name => "rcsinfo", type => 'hidden');
 	$form->field(name => "subpage", type => 'hidden');
-	$form->field(name => "page", value => pagetitle($page, 1), force => 1);
+	$form->field(name => "page", value => $page, force => 1);
 	$form->field(name => "type", value => $type, force => 1);
 	$form->field(name => "comments", type => "text", size => 80);
 	$form->field(name => "editcontent", type => "textarea", rows => 20,
@@ -486,8 +485,8 @@ sub cgi_editpage ($$) { #{{{
 			
 			$form->tmpl_param("page_select", 1);
 			$form->field(name => "page", type => 'select',
-				options => [ map { pagetitle($_, 1) } @editable_locs ],
-				value => pagetitle($best_loc, 1));
+				options => [ map { [ $_, pagetitle($_, 1) ] } @editable_locs ],
+				value => $best_loc);
 			$form->field(name => "type", type => 'select',
 				options => \@page_types);
 			$form->title(sprintf(gettext("creating %s"), pagetitle($page)));
diff --git a/IkiWiki/Plugin/editdiff.pm b/IkiWiki/Plugin/editdiff.pm
index b8ecaa3d7..d45c73e8f 100644
--- a/IkiWiki/Plugin/editdiff.pm
+++ b/IkiWiki/Plugin/editdiff.pm
@@ -50,7 +50,7 @@ sub formbuilder_setup { #{{{
 
 	return if $form->field("do") ne "edit";
 
-	$page = IkiWiki::titlepage(IkiWiki::possibly_foolish_untaint($page));
+	$page = IkiWiki::possibly_foolish_untaint($page);
 	return unless exists $pagesources{$page};
 
 	push @{$params{buttons}}, "Diff";
diff --git a/IkiWiki/Plugin/inline.pm b/IkiWiki/Plugin/inline.pm
index 344620ebe..8890e5ed0 100644
--- a/IkiWiki/Plugin/inline.pm
+++ b/IkiWiki/Plugin/inline.pm
@@ -70,12 +70,12 @@ sub sessioncgi () { #{{{
 	my $session=shift;
 
 	if ($q->param('do') eq 'blog') {
-		my $page=decode_utf8($q->param('title'));
-		$page=~s/\///g; # no slashes in blog posts
+		my $page=IkiWiki::titlepage(decode_utf8($q->param('title')));
+		$page=~s/(\/)/"__".ord($1)."__"/eg; # don't create subdirs
 		# if the page already exists, munge it to be unique
 		my $from=$q->param('from');
 		my $add="";
-		while (exists $IkiWiki::pagecase{lc($from."/".IkiWiki::titlepage($page).$add)}) {
+		while (exists $IkiWiki::pagecase{lc($from."/".$page.$add)}) {
 			$add=1 unless length $add;
 			$add++;
 		}
@@ -278,7 +278,7 @@ sub preprocess_inline (@) { #{{{
 					}
 					if (length $config{cgiurl} && defined $type) {
 						$template->param(have_actions => 1);
-						$template->param(editurl => cgiurl(do => "edit", page => pagetitle($page, 1)));
+						$template->param(editurl => cgiurl(do => "edit", page => $page));
 					}
 				}
 	
diff --git a/IkiWiki/Render.pm b/IkiWiki/Render.pm
index 5184be2df..c241fd40b 100644
--- a/IkiWiki/Render.pm
+++ b/IkiWiki/Render.pm
@@ -80,7 +80,7 @@ sub genpage ($$) { #{{{
 	my $actions=0;
 
 	if (length $config{cgiurl}) {
-		$template->param(editurl => cgiurl(do => "edit", page => pagetitle($page, 1)));
+		$template->param(editurl => cgiurl(do => "edit", page => $page));
 		$template->param(prefsurl => cgiurl(do => "prefs"));
 		$actions++;
 	}
-- 
cgit v1.2.3


From 6e2dc2b1fd690f36365d7d0bdd18d220b0aaa524 Mon Sep 17 00:00:00 2001
From: Joey Hess <joey@kodama.kitenet.net>
Date: Sun, 6 Jul 2008 16:56:50 -0400
Subject: avoid uninitialised value

---
 IkiWiki/Plugin/editdiff.pm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'IkiWiki')

diff --git a/IkiWiki/Plugin/editdiff.pm b/IkiWiki/Plugin/editdiff.pm
index d45c73e8f..9872e9686 100644
--- a/IkiWiki/Plugin/editdiff.pm
+++ b/IkiWiki/Plugin/editdiff.pm
@@ -46,10 +46,10 @@ sub diff ($$) { #{{{
 sub formbuilder_setup { #{{{
 	my %params=@_;
 	my $form=$params{form};
-	my $page=$form->field("page");
 
-	return if $form->field("do") ne "edit";
+	return if defined ! $form->field("do") || $form->field("do") ne "edit";
 
+	my $page=$form->field("page");
 	$page = IkiWiki::possibly_foolish_untaint($page);
 	return unless exists $pagesources{$page};
 
-- 
cgit v1.2.3