inline: Prevent creating a file named ".mdwn" when the postform is submitted with an empty title.

master
Joey Hess 2016-09-21 13:51:42 -04:00
parent 8a638d6b53
commit 68e2320696
No known key found for this signature in database
GPG Key ID: C910D9222512E3C7
3 changed files with 13 additions and 1 deletions

View File

@ -121,6 +121,9 @@ sub sessioncgi ($$) {
if ($q->param('do') eq 'blog') { if ($q->param('do') eq 'blog') {
my $page=titlepage(decode_utf8(scalar $q->param('title'))); my $page=titlepage(decode_utf8(scalar $q->param('title')));
$page=~s/(\/)/"__".ord($1)."__"/eg; # don't create subdirs $page=~s/(\/)/"__".ord($1)."__"/eg; # don't create subdirs
if (! length $page) {
error(gettext("please enter a page title"));
}
# if the page already exists, munge it to be unique # if the page already exists, munge it to be unique
my $from=$q->param('from'); my $from=$q->param('from');
my $add=""; my $add="";

7
debian/changelog vendored
View File

@ -1,3 +1,10 @@
ikiwiki (3.20160906) UNRELEASED; urgency=medium
* inline: Prevent creating a file named ".mdwn" when the
postform is submitted with an empty title.
-- Joey Hess <id@joeyh.name> Wed, 21 Sep 2016 13:48:32 -0400
ikiwiki (3.20160905) unstable; urgency=medium ikiwiki (3.20160905) unstable; urgency=medium
[ Joey Hess ] [ Joey Hess ]

View File

@ -1,4 +1,6 @@
When using inline with postform=yes, the user can click on the edit button When using inline with postform=yes, the user can click on the edit button
without providing a title, and are allowed to save the page. This results without providing a title, and are allowed to save the page. This results
in a file with a name like ".mdwn", which ikiwiki won't render. in a file with a name like ".mdwn", which ikiwiki won't render.
-[[Joey]] --[[Joey]]
> [[done]]; made it error out in this case.