comments: use comments_pagespec for authorization, not just UI
authorSimon McVittie <smcv@debian.org>
Sat, 1 Mar 2014 17:25:39 +0000 (17:25 +0000)
committerSimon McVittie <smcv@debian.org>
Fri, 4 Jul 2014 22:27:43 +0000 (23:27 +0100)
IkiWiki/Plugin/comments.pm

index a0ca9f32e484090969fbfa605875268cd112e9d8..98ae13810200269a34fbfb8b24093e26dc5ad4bb 100644 (file)
@@ -438,6 +438,16 @@ sub editcomment ($$) {
                        $page));
        }
 
                        $page));
        }
 
+       # There's no UI to get here, but someone might construct the URL,
+       # leading to a comment that exists in the repository but isn't
+       # shown
+       if (!pagespec_match($page, $config{comments_pagespec},
+               location => $page)) {
+               error(sprintf(gettext(
+                       "comments on page '%s' are not allowed"),
+                       $page));
+       }
+
        if (pagespec_match($page, $config{comments_closed_pagespec},
                location => $page)) {
                error(sprintf(gettext(
        if (pagespec_match($page, $config{comments_closed_pagespec},
                location => $page)) {
                error(sprintf(gettext(