From 12eb585353660d121e48d5796d35354b66c7e522 Mon Sep 17 00:00:00 2001 From: Joey Hess Date: Sat, 20 Sep 2008 22:48:22 -0400 Subject: [PATCH] add missing page name sanity check --- IkiWiki/Plugin/editpage.pm | 5 +++-- debian/changelog | 2 ++ 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/IkiWiki/Plugin/editpage.pm b/IkiWiki/Plugin/editpage.pm index bb21ed2be..68f43bf16 100644 --- a/IkiWiki/Plugin/editpage.pm +++ b/IkiWiki/Plugin/editpage.pm @@ -85,8 +85,9 @@ sub cgi_editpage ($$) { #{{{ }); decode_form_utf8($form); - # This untaint is safe because we check file_pruned. - my $page=$form->field('page'); + # This untaint is safe because we check file_pruned and + # wiki_file_regexp. + my ($page)=$form->field('page')=~/$config{wiki_file_regexp}/; $page=possibly_foolish_untaint($page); my $absolute=($page =~ s#^/+##); if (! defined $page || ! length $page || diff --git a/debian/changelog b/debian/changelog index 6019e3960..d67fb73ce 100644 --- a/debian/changelog +++ b/debian/changelog @@ -14,6 +14,8 @@ ikiwiki (2.65) UNRELEASED; urgency=low (willu) * edittemplate: Add "silent" parameter. (Willu) * edittemplate: Link to template, to allow creating it. (Willu) + * editpage: Add a missing check that the page name contains only legal + characters, in addition to the existing check for pruned filenames. -- Joey Hess Wed, 17 Sep 2008 14:26:56 -0400 -- 2.32.0.93.g670b81a890