2006-09-16 02:26:16 +02:00
|
|
|
If you
|
|
|
|
|
|
2007-11-17 22:37:25 +01:00
|
|
|
* Add a link to a non-existant page and save. (e.g. somewhere-over-the-rainbow)
|
2006-09-16 02:26:16 +02:00
|
|
|
* Click the question mark to create the page.
|
|
|
|
|
* Click the cancel button.
|
|
|
|
|
|
|
|
|
|
You get a 404 as the page doesn't exist. This patch redirects to the from location
|
|
|
|
|
if it is known.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
=== modified file 'IkiWiki/CGI.pm'
|
|
|
|
|
--- IkiWiki/CGI.pm
|
|
|
|
|
+++ IkiWiki/CGI.pm
|
|
|
|
|
@@ -427,7 +427,11 @@
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if ($form->submitted eq "Cancel") {
|
|
|
|
|
- redirect($q, "$config{url}/".htmlpage($page));
|
|
|
|
|
+ if ( $newpage && defined $from ) {
|
|
|
|
|
+ redirect($q, "$config{url}/".htmlpage($from));
|
|
|
|
|
+ } else {
|
|
|
|
|
+ redirect($q, "$config{url}/".htmlpage($page));
|
|
|
|
|
+ }
|
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
elsif ($form->submitted eq "Preview") {
|
|
|
|
|
|
2006-09-16 03:23:14 +02:00
|
|
|
> I think you mean to use `$newfile`? I've applied a modieid version
|
|
|
|
|
> that also deal with creating a new page with no defined $from location.
|
|
|
|
|
> [[bugs/done]] --[[Joey]]
|
2006-09-16 02:26:16 +02:00
|
|
|
|
2006-09-16 03:32:08 +02:00
|
|
|
>> Yes of course, that's what I get for submitting an untested patch!
|
|
|
|
|
>> I must stop doing that.
|
|
|
|
|
|
2006-09-16 02:26:16 +02:00
|
|
|
[P.S. just above that is
|
|
|
|
|
|
|
|
|
|
$type=$form->param('type');
|
|
|
|
|
if (defined $type && length $type && $hooks{htmlize}{$type}) {
|
|
|
|
|
$type=possibly_foolish_untaint($type);
|
|
|
|
|
}
|
|
|
|
|
....
|
|
|
|
|
$file=$page.".".$type;
|
|
|
|
|
|
|
|
|
|
I'm a little worried by the `possibly_foolish_untaint` (good name for it by the way,
|
|
|
|
|
makes it stick out). I don't think much can be done to exploit this (if anything),
|
|
|
|
|
but it seems like you could have a very strict regex there rather than the untaint,
|
|
|
|
|
is there aren't going to be many possible extensions. Something like `/(.\w+)+/`
|
|
|
|
|
(groups of dot separated alpha-num chars if my perl-foo isn't failing me). You could
|
|
|
|
|
at least exclude `/` and `..`. I'm happy to turn this in to a patch if you agree.]
|
|
|
|
|
|
2006-09-16 03:50:29 +02:00
|
|
|
> The reason it's safe to use `possibly_foolish_untaint` here is because
|
2006-09-16 03:23:14 +02:00
|
|
|
> of the check for $hooks{htmlize}{$type}. This limits it to types
|
|
|
|
|
> that have a registered htmlize hook (mdwn, etc), and not whatever random
|
|
|
|
|
> garbage an attacker might try to put in. If it wasn't for that check,
|
2006-09-16 03:50:29 +02:00
|
|
|
> using `possibly_foolish_untaint` there would be _very_ foolish indeed..
|
2006-09-16 03:23:14 +02:00
|
|
|
> --[[Joey]]
|
2006-09-16 03:32:08 +02:00
|
|
|
|
|
|
|
|
>> Nice, sorry I missed it.
|
|
|
|
|
>> I must say thankyou for creating ikiwiki.
|
2006-09-16 03:50:29 +02:00
|
|
|
>> The more I look at it, the more I admire what you are doing with it and how you are going about it
|
