From be02a80b7a19f3c33a8ea42c0750d94e0a91206f Mon Sep 17 00:00:00 2001
From: Joey Hess <joey@kitenet.net>
Date: Mon, 28 Mar 2011 12:21:12 -0400
Subject: meta: Security fix; don't allow alternative stylesheets to be added
 on pages where the htmlscrubber is enabled.

---
 IkiWiki/Plugin/meta.pm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'IkiWiki')

diff --git a/IkiWiki/Plugin/meta.pm b/IkiWiki/Plugin/meta.pm
index ad6d1a8e3..1a9f94a12 100644
--- a/IkiWiki/Plugin/meta.pm
+++ b/IkiWiki/Plugin/meta.pm
@@ -174,10 +174,10 @@ sub preprocess (@) {
 		if (! length $stylesheet) {
 			error gettext("stylesheet not found")
 		}
-		push @{$metaheaders{$page}}, '<link href="'.urlto($stylesheet, $page).
+		push @{$metaheaders{$page}}, scrub('<link href="'.urlto($stylesheet, $page).
 			'" rel="'.encode_entities($rel).
 			'" title="'.encode_entities($title).
-			"\" type=\"text/css\" />";
+			"\" type=\"text/css\" />", $page, $destpage);
 	}
 	elsif ($key eq 'openid') {
 		my $delegate=0; # both by default
-- 
cgit v1.2.3