X-Git-Url: https://sipb.mit.edu/gitweb.cgi/ikiwiki.git/blobdiff_plain/d534483b9befc360b3d973091b1b7f5692f15a6e..e49ff966a39d1037ccbf168b8dbd12618cf1b41e:/IkiWiki/Plugin/meta.pm

diff --git a/IkiWiki/Plugin/meta.pm b/IkiWiki/Plugin/meta.pm
index 8244cf718..15a8bad84 100644
--- a/IkiWiki/Plugin/meta.pm
+++ b/IkiWiki/Plugin/meta.pm
@@ -26,12 +26,15 @@ sub preprocess (@) { #{{{
 	delete $params{$key};
 	my $page=$params{page};
 	delete $params{page};
+	delete $params{destpage};
+
+	eval q{use CGI 'escapeHTML'};
 
 	if ($key eq 'link') {
 		if (%params) {
 			$meta{$page}='' unless exists $meta{$page};
-			$meta{$page}.="<link href=\"$value\" ".
-				join(" ", map { "$_=\"$params{$_}\"" } keys %params).
+			$meta{$page}.="<link href=\"".escapeHTML($value)."\" ".
+				join(" ", map { escapeHTML("$_=\"$params{$_}\"") } keys %params).
 				" />\n";
 		}
 		else {
@@ -40,22 +43,25 @@ sub preprocess (@) { #{{{
 		}
 	}
 	elsif ($key eq 'title') {
-		$title{$page}=$value;
+		$title{$page}=escapeHTML($value);
 	}
 	else {
 		$meta{$page}='' unless exists $meta{$page};
-		$meta{$page}.="<meta name=\"$key\" content=\"$value\" />\n";
+		$meta{$page}.="<meta name=\"".escapeHTML($key)."\" content=\"".escapeHTML($value)."\" />\n";
 	}
 
 	return "";
 } # }}}
 
-sub pagetemplate ($$) { #{{{
-        my $page=shift;
-        my $template=shift;
+sub pagetemplate (@) { #{{{
+	my %params=@_;
+        my $page=$params{page};
+        my $template=$params{template};
 
-	$template->param(meta => $meta{$page}) if exists $meta{$page};
-	$template->param(title => $title{$page}) if exists $title{$page};
+	$template->param(meta => $meta{$page})
+		if exists $meta{$page} && $template->query(name => "meta");
+	$template->param(title => $title{$page})
+		if exists $title{$page} && $template->query(name => "title");
 } # }}}
 
 1