urosm
/
ikiwiki
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

comments: sanitize the body of each comment before posting it 

This should ensure that users can't "break out" from the enclosing
<div>, making it impossible to forge comments (assuming htmlscrubber
is enabled, and so is either htmlbalance or htmltidy).
master
Simon McVittie 2008-11-18 10:29:16 +00:00
parent 57e40b9ce5
commit ebe140201e
1 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
IkiWiki/Plugin/comments.pm
View File

@ -250,6 +250,17 @@ sub sessioncgi ($$) { #{{{
$body =~ s/>/&gt;/g; $body =~ s/>/&gt;/g;
} }
IkiWiki::run_hooks(sanitize => sub {
# $fake is a possible location for this comment. We don't
# know yet what the comment number *actually* is.
my $fake = "$page/_comment_1";
$body=shift->(
page => $fake,
destpage => $fake,
content => $body,
);
});
# In this template, the [[!meta]] directives should stay at the end, # In this template, the [[!meta]] directives should stay at the end,
# so that they will override anything the user specifies. (For # so that they will override anything the user specifies. (For
# instance, [[!meta author="I can fake the author"]]...) # instance, [[!meta author="I can fake the author"]]...)
@ -268,9 +279,9 @@ sub sessioncgi ($$) { #{{{
# - this means that if they do, rocks fall and everyone dies # - this means that if they do, rocks fall and everyone dies
if ($form->submitted eq PREVIEW) { if ($form->submitted eq PREVIEW) {
# $fake is a location that has the same number of slashes # $fake is a possible location for this comment. We don't
# as the eventual location of this comment. # know yet what the comment number *actually* is.
my $fake = "$page/_comments_hypothetical"; my $fake = "$page/_comment_1";
my $preview = IkiWiki::htmlize($fake, $page, 'mdwn', my $preview = IkiWiki::htmlize($fake, $page, 'mdwn',
IkiWiki::linkify($page, $page, IkiWiki::linkify($page, $page,
IkiWiki::preprocess($page, $page, IkiWiki::preprocess($page, $page,