comments: Fix XSS security hole due to missing validation of page name.

[ikiwiki.git] / IkiWiki / Plugin / comments.pm

diff --git a/IkiWiki/Plugin/comments.pm b/IkiWiki/Plugin/comments.pm
index a3cb7c3d56c784f18251aaa34a14776d6f107962..d9183970d8b1525c34a69a68dcec57fa88eaf58e 100644 (file)
--- a/IkiWiki/Plugin/comments.pm
+++ b/IkiWiki/Plugin/comments.pm
@@ -237,7 +237,7 @@ sub preprocess {
        }
 
        if ($params{page} =~ m/\/\Q$config{comments_pagename}\E\d+_/) {
-               $pagestate{$page}{meta}{permalink} = urlto(IkiWiki::dirname($params{page}), undef).
+               $pagestate{$page}{meta}{permalink} = urlto(IkiWiki::dirname($params{page})).
                        "#".page_to_id($params{page});
        }
 
@@ -364,18 +364,16 @@ sub editcomment ($$) {
        }
 
        # The untaint is OK (as in editpage) because we're about to pass
-       # it to file_pruned anyway
-       my $page = $form->field('page');
+       # it to file_pruned and wiki_file_regexp anyway.
+       my $page = $form->field('page')=~/$config{wiki_file_regexp}/;
        $page = IkiWiki::possibly_foolish_untaint($page);
        if (! defined $page || ! length $page ||
                IkiWiki::file_pruned($page)) {
                error(gettext("bad page name"));
        }
 
-       my $baseurl = urlto($page, undef);
-
        $form->title(sprintf(gettext("commenting on %s"),
-                       IkiWiki::pagetitle($page)));
+                       IkiWiki::pagetitle(IkiWiki::basename($page))));
 
        $form->tmpl_param('helponformattinglink',
                htmllink($page, $page, 'ikiwiki/formatting',
@@ -385,8 +383,7 @@ sub editcomment ($$) {
 
        if ($form->submitted eq CANCEL) {
                # bounce back to the page they wanted to comment on, and exit.
-               # CANCEL need not be considered in future
-               IkiWiki::redirect($cgi, urlto($page, undef));
+               IkiWiki::redirect($cgi, urlto($page));
                exit;
        }
 
@@ -507,7 +504,7 @@ sub editcomment ($$) {
                        IkiWiki::saveindex();
 
                        IkiWiki::printheader($session);
-                       print IkiWiki::misctemplate(gettext(gettext("comment stored for moderation")),
+                       print IkiWiki::cgitemplate($cgi, gettext(gettext("comment stored for moderation")),
                                "<p>".
                                gettext("Your comment will be posted after moderator review").
                                "</p>");
@@ -552,13 +549,13 @@ sub editcomment ($$) {
                # Jump to the new comment on the page.
                # The trailing question mark tries to avoid broken
                # caches and get the most recent version of the page.
-               IkiWiki::redirect($cgi, urlto($page, undef).
+               IkiWiki::redirect($cgi, urlto($page).
                        "?updated#".page_to_id($location));
 
        }
        else {
-               IkiWiki::showform ($form, \@buttons, $session, $cgi,
-                       forcebaseurl => $baseurl, page => $page);
+               IkiWiki::showform($form, \@buttons, $session, $cgi,
+                       page => $page);
        }
 
        exit;
@@ -663,7 +660,7 @@ sub commentmoderation ($$) {
        IkiWiki::run_hooks(format => sub {
                $out = shift->(page => "", content => $out);
        });
-       print IkiWiki::misctemplate(gettext("comment moderation"), $out);
+       print IkiWiki::cgitemplate($cgi, gettext("comment moderation"), $out);
        exit;
 }
 
@@ -811,14 +808,14 @@ sub pagetemplate (@) {
        if ($shown) {
                if ($template->query(name => 'commentsurl')) {
                        $template->param(commentsurl =>
-                               urlto($page, undef).'#comments');
+                               urlto($page).'#comments');
                }
 
                if ($template->query(name => 'atomcommentsurl') && $config{usedirs}) {
                        # This will 404 until there are some comments, but I
                        # think that's probably OK...
                        $template->param(atomcommentsurl =>
-                               urlto($page, undef).'comments.atom');
+                               urlto($page).'comments.atom');
                }
 
                if ($template->query(name => 'commentslink')) {