img: Fix a bug that could taint @links with undef values.

diff --git a/IkiWiki/Plugin/img.pm b/IkiWiki/Plugin/img.pm
index c1048d3c927c3fad75c9a7b88b32dbe3833aa814..82db15a7ea3a6b5cf47b1cb93010792e765479fc 100644 (file)
--- a/IkiWiki/Plugin/img.pm
+++ b/IkiWiki/Plugin/img.pm
@@ -26,6 +26,10 @@ sub preprocess (@) {
        my ($image) = $_[0] =~ /$config{wiki_file_regexp}/; # untaint
        my %params=@_;
 
        my ($image) = $_[0] =~ /$config{wiki_file_regexp}/; # untaint
        my %params=@_;
 

+       if (! defined $image) {
+               error("bad image filename");
+       }
+

        if (exists $imgdefaults{$params{page}}) {
                foreach my $key (keys %{$imgdefaults{$params{page}}}) {
                        if (! exists $params{$key}) {
        if (exists $imgdefaults{$params{page}}) {
                foreach my $key (keys %{$imgdefaults{$params{page}}}) {
                        if (! exists $params{$key}) {

diff --git a/debian/changelog b/debian/changelog
index 0ec696d3c0214dbb37e44e7daabdf10bff9d9a5a..5d27b7af05d5e87cc68bab818fc4bc950effb058 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,6 +1,7 @@
 ikiwiki (3.20100123) UNRELEASED; urgency=low
 
   * template: Preprocess parameters before htmlizing.
 ikiwiki (3.20100123) UNRELEASED; urgency=low
 
   * template: Preprocess parameters before htmlizing.

+  * img: Fix a bug that could taint @links with undef values.

 
  -- Joey Hess <joeyh@debian.org>  Tue, 26 Jan 2010 22:25:33 -0500
 
 
  -- Joey Hess <joeyh@debian.org>  Tue, 26 Jan 2010 22:25:33 -0500