X-Git-Url: https://sipb.mit.edu/gitweb.cgi/ikiwiki.git/blobdiff_plain/26774c931ce1aa4b91e7129ad602a23b244008b2..aa0600bda3be730f6236b6f53fab092b83a2deea:/doc/bugs/404_when_cancel_create_page.mdwn diff --git a/doc/bugs/404_when_cancel_create_page.mdwn b/doc/bugs/404_when_cancel_create_page.mdwn index 091254cb5..acf5ac9b3 100644 --- a/doc/bugs/404_when_cancel_create_page.mdwn +++ b/doc/bugs/404_when_cancel_create_page.mdwn @@ -29,6 +29,9 @@ if it is known. > that also deal with creating a new page with no defined $from location. > [[bugs/done]] --[[Joey]] +>> Yes of course, that's what I get for submitting an untested patch! +>> I must stop doing that. + [P.S. just above that is $type=$form->param('type'); @@ -45,9 +48,13 @@ is there aren't going to be many possible extensions. Something like `/(.\w+)+/` (groups of dot separated alpha-num chars if my perl-foo isn't failing me). You could at least exclude `/` and `..`. I'm happy to turn this in to a patch if you agree.] -> The reason it's safe to use possibly_foolish_untaint here is because +> The reason it's safe to use `possibly_foolish_untaint` here is because > of the check for $hooks{htmlize}{$type}. This limits it to types > that have a registered htmlize hook (mdwn, etc), and not whatever random > garbage an attacker might try to put in. If it wasn't for that check, -> using possibly_foolish_untaint there would be _very_ foolish indeed.. +> using `possibly_foolish_untaint` there would be _very_ foolish indeed.. > --[[Joey]] + +>> Nice, sorry I missed it. +>> I must say thankyou for creating ikiwiki. +>> The more I look at it, the more I admire what you are doing with it and how you are going about it