meta: Security fix; don't allow alternative stylesheets to be added on pages where...

[ikiwiki.git] / IkiWiki / Plugin / meta.pm

diff --git a/IkiWiki/Plugin/meta.pm b/IkiWiki/Plugin/meta.pm
index abc8f1b1aa1089f60ba62e93dbcca0062696f4f6..1a9f94a124d766687da1daeac391cf8b479a4cec 100644 (file)
--- a/IkiWiki/Plugin/meta.pm
+++ b/IkiWiki/Plugin/meta.pm
@@ -174,10 +174,10 @@ sub preprocess (@) {
                if (! length $stylesheet) {
                        error gettext("stylesheet not found")
                }
-               push @{$metaheaders{$page}}, '<link href="'.urlto($stylesheet, $page).
+               push @{$metaheaders{$page}}, scrub('<link href="'.urlto($stylesheet, $page).
                        '" rel="'.encode_entities($rel).
                        '" title="'.encode_entities($title).
-                       "\" type=\"text/css\" />";
+                       "\" type=\"text/css\" />", $page, $destpage);
        }
        elsif ($key eq 'openid') {
                my $delegate=0; # both by default
@@ -298,6 +298,11 @@ sub pagetemplate (@) {
                        if exists $pagestate{$page}{meta}{$field} && $template->query(name => $field);
        }
 
+       foreach my $field (qw{permalink}) {
+               $template->param($field => IkiWiki::urlabs($pagestate{$page}{meta}{$field}, $config{url}))
+                       if exists $pagestate{$page}{meta}{$field} && $template->query(name => $field);
+       }
+
        foreach my $field (qw{description}) {
                $template->param($field => HTML::Entities::encode_numeric($pagestate{$page}{meta}{$field}))
                        if exists $pagestate{$page}{meta}{$field} && $template->query(name => $field);