Commit: 6d67361a262d084e12118302669158032859fbeb - pukiwiki-fork (git)

Commit MetaInfo

• Revisión: 6d67361a262d084e12118302669158032859fbeb (tree)
• Tiempo: 2002-06-22 18:31:43
• Autor: masui <masui>
• Commiter: masui

Log Message

Plugin Error: Load Denied: 1

fix < > & " quote

Cambiar Resumen

• modified: func.php
• modified: html.php
• modified: pukiwiki.php

Diferencia incremental

--- a/func.php
+++ b/func.php
@@ -1,6 +1,6 @@
 <?
 // PukiWiki - Yet another WikiWikiWeb clone.
-// $Id: func.php,v 1.1 2002/06/21 05:21:46 masui Exp $
+// $Id: func.php,v 1.2 2002/06/22 09:31:43 masui Exp $
 /////////////////////////////////////////////////
 
 // 検索
@@ -92,13 +92,13 @@ function do_search($word,$type="AND",$non_format=0)
 		$retvals = "<ul>\n" . join("\n",$retval) . "</ul>\n<br>\n";
 		
 		if($type=="AND")
-			$retvals.= str_replace('$1',$result_word,str_replace('$2',count($retval),str_replace('$3',$cnt,$_msg_andresult)));
+			$retvals.= str_replace('$1',htmlspecialchars($result_word),str_replace('$2',count($retval),str_replace('$3',$cnt,$_msg_andresult)));
 		else
-			$retvals.= str_replace('$1',$result_word,str_replace('$2',count($retval),str_replace('$3',$cnt,$_msg_orresult)));
+			$retvals.= str_replace('$1',htmlspecialchars($result_word),str_replace('$2',count($retval),str_replace('$3',$cnt,$_msg_orresult)));
 
 	}
 	else
-		$retvals .= str_replace('$1',$result_word,$_msg_notfoundresult);
+		$retvals .= str_replace('$1',htmlspecialchars($result_word),$_msg_notfoundresult);
 	return $retvals;
 }
 

--- a/html.php
+++ b/html.php
@@ -1,6 +1,6 @@
 <?
 // PukiWiki - Yet another WikiWikiWeb clone.
-// $Id: html.php,v 1.3 2002/06/21 12:33:29 masui Exp $
+// $Id: html.php,v 1.4 2002/06/22 09:31:43 masui Exp $
 /////////////////////////////////////////////////
 
 // 本文をページ名から出力
@@ -229,7 +229,7 @@ function convert_html($string)
 
 	$longtaketime = getmicrotime() - $start_mtime;
 
-	$str = preg_replace("/&((amp)|(quot)|(nbsp)|(lt)|(gt));/","&$1;",$str);
+#	$str = preg_replace("/&((amp)|(quot)|(nbsp)|(lt)|(gt));/","&$1;",$str);
 
 	return $str;
 }
@@ -593,17 +593,14 @@ function make_link($name)
 
 	if(preg_match("/^\[\[([^\]]+)\:((https?|ftp|news)([^\]]+))\]\]$/",$name,$match))
 	{
-		$match[2] = str_replace($aryconv_htmlspecial,$aryconv_html,$match[2]);
 		return "<a href=\"$match[2]\" target=\"$link_target\">$match[1]</a>";
 	}
 	else if(preg_match("/^\[((https?|ftp|news)([^\]\s]+))\s([^\]]+)\]$/",$name,$match))
 	{
-		$match[1] = str_replace($aryconv_htmlspecial,$aryconv_html,$match[1]);
 		return "<a href=\"$match[1]\" target=\"$link_target\">$match[4]</a>";
 	}
 	else if(preg_match("/^(https?|ftp|news).*?(\.gif|\.png|\.jpeg|\.jpg)?$/",$name,$match))
 	{
-		$name = str_replace($aryconv_htmlspecial,$aryconv_html,$name);
 		if($match[2])
 			return "<a href=\"$name\" target=\"$link_target\"><img src=\"$name\" border=\"0\"></a>";
 		else
@@ -611,17 +608,13 @@ function make_link($name)
 	}
 	else if(preg_match("/^\[\[([^\]]+)\:([[:alnum:]\-_.]+@[[:alnum:]\-_]+\.[[:alnum:]\-_\.]+)\]\]/",$name,$match))
 	{
-		$match[1] = str_replace($aryconv_htmlspecial,$aryconv_html,$match[1]);
-		$match[2] = str_replace($aryconv_htmlspecial,$aryconv_html,$match[2]);
-
 		return "<a href=\"mailto:$match[2]\">$match[1]</a>";
 	}
 	else if(preg_match("/^([[:alnum:]\-_]+@[[:alnum:]\-_]+\.[[:alnum:]\-_\.]+)/",$name))
 	{
-		$name = str_replace($aryconv_htmlspecial,$aryconv_html,$name);
 		return "<a href=\"mailto:$name\">$page</a>";
 	}
-	else if(preg_match("/^($InterWikiName)$/",str_replace($aryconv_htmlspecial,$aryconv_html,$name)))
+	else if(preg_match("/^($InterWikiName)$/",$name))
 	{
 		$page = strip_bracket($page);
 		$percent_name = str_replace($aryconv_htmlspecial,$aryconv_html,$name);
@@ -629,9 +622,9 @@ function make_link($name)
 
 		return "<a href=\"$script?$percent_name\" target=\"$interwiki_target\">$page</a>";
 	}
-	else if(preg_match("/^($BracketName)|($WikiName)$/",str_replace($aryconv_htmlspecial,$aryconv_html,$name)))
+	else if(preg_match("/^($BracketName)|($WikiName)$/",$name))
 	{
-		if(preg_match("/^([^>]+)>([^>]+)$/",strip_bracket(str_replace($aryconv_htmlspecial,$aryconv_html,$name)),$match))
+		if(preg_match("/^([^>]+)>([^>]+)$/",strip_bracket($name),$match))
 		{
 			$page = $match[1];
 			$name = $match[2];
@@ -641,14 +634,14 @@ function make_link($name)
 				$name = "[[$name]]";
 		}
 		
-		if(preg_match("/^\[\[\.\/([^\]]*)\]\]/",str_replace($aryconv_htmlspecial,$aryconv_html,$name),$match))
+		if(preg_match("/^\[\[\.\/([^\]]*)\]\]/",$name,$match))
 		{
 			if(!$match[1])
 				$name = $vars["page"];
 			else
-				$name = "[[".strip_bracket($vars[page])."/$match[1]]]";
+				$name = "[[".strip_bracket($vars["page"])."/$match[1]]]";
 		}
-		else if(preg_match("/^\[\[\..\/([^\]]+)\]\]/",str_replace($aryconv_htmlspecial,$aryconv_html,$name),$match))
+		else if(preg_match("/^\[\[\..\/([^\]]+)\]\]/",$name,$match))
 		{
 			for($i=0;$i<substr_count($name,"../");$i++)
 				$name = preg_replace("/(.+)\/([^\/]+)$/","$1",strip_bracket($vars["page"]));

--- a/pukiwiki.php
+++ b/pukiwiki.php
@@ -26,7 +26,7 @@
 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 // GNU General Public License for more details.
 //
-// $Id: pukiwiki.php,v 1.3 2002/06/21 12:33:29 masui Exp $
+// $Id: pukiwiki.php,v 1.4 2002/06/22 09:31:43 masui Exp $
 /////////////////////////////////////////////////
 
 
@@ -400,10 +400,10 @@ else if(arg_check("diff"))
 		$title = str_replace('$1',strip_bracket($get["page"]),$_title_diff);
 		$page = str_replace('$1',make_search($get["page"]),$_title_diff);
 
-		$diffdata = get_source($get["page"]);
+		$diffdata = htmlspecialchars(join("",get_source($get["page"])));
 		$body .= "<font color=\"blue\">\n"
 			."<pre>\n"
-			.join("",$diffdata)
+			.$diffdata
 			."\n"
 			."</pre>\n"
 			."</font>\n";
@@ -414,6 +414,7 @@ else if(arg_check("diff"))
 		$page = str_replace('$1',make_search($get["page"]),$_title_diff);
 
 		$diffdata = file(DIFF_DIR.encode($get["page"]).".txt");
+		$diffdata = preg_replace("/&/","&amp;",$diffdata);
 		$diffdata = preg_replace("/</","&lt;",$diffdata);
 		$diffdata = preg_replace("/>/","&gt;",$diffdata);
 		$diffdata = preg_replace("/^(\-)(.*)/","<font color=\"red\"> $2</font>",$diffdata);
@@ -430,7 +431,7 @@ else if(arg_check("search"))
 {
 	if($vars["word"])
 	{
-		$title = $page = str_replace('$1',$vars["word"],$_title_result);
+		$title = $page = str_replace('$1',htmlspecialchars($vars["word"]),$_title_result);
 	}
 	else
 	{
@@ -446,7 +447,7 @@ else if(arg_check("search"))
 	else if($vars["type"]=="OR")               $or_check = "checked";
 
 	$body .= "<form action=\"$script?cmd=search\" method=\"post\">\n"
-		."<input type=\"text\" name=\"word\" size=\"20\" value=\"".$vars["word"]."\">\n"
+		."<input type=\"text\" name=\"word\" size=\"20\" value=\"".htmlspecialchars($vars["word"])."\">\n"
 		."<input type=\"radio\" name=\"type\" value=\"AND\" $and_check>$_btn_and\n"
 		."<input type=\"radio\" name=\"type\" value=\"OR\" $or_check>$_btn_or\n"
 		."&nbsp;<input type=\"submit\" value=\"$_btn_search\">\n"
@@ -515,7 +516,7 @@ else if($do_backup && arg_check("backup"))
 			$title = str_replace('$1',$pagename,$_title_backupdiff)."(No.$get[age])";
 			$page = str_replace('$1',make_search($get["page"]),$_title_backupdiff)."(No.$get[age])";
 			
-			$backupdata = @join("",get_backup($get[age]-1,encode($get["page"]).".txt"));
+			$backupdata = htmlspecialchars(@join("",get_backup($get[age]-1,encode($get["page"]).".txt")));
 			$postdata = @join("",get_backup($get[age],encode($get["page"]).".txt"));
 			$diffdata = split("\n",do_diff($backupdata,$postdata));
 		}
@@ -524,7 +525,7 @@ else if($do_backup && arg_check("backup"))
 			$title = str_replace('$1',$pagename,$_title_backupnowdiff)."(No.$get[age])";
 			$page = str_replace('$1',make_search($get["page"]),$_title_backupnowdiff)."(No.$get[age])";
 			
-			$backupdata = @join("",get_backup($get[age],encode($get["page"]).".txt"));
+			$backupdata = htmlspecialchars(@join("",get_backup($get[age],encode($get["page"]).".txt")));
 			$postdata = @join("",get_source($get["page"]));
 			$diffdata = split("\n",do_diff($backupdata,$postdata));
 		}
@@ -532,7 +533,7 @@ else if($do_backup && arg_check("backup"))
 		{
 			$title = str_replace('$1',$pagename,$_title_backupsource)."(No.$get[age])";
 			$page = str_replace('$1',make_search($get["page"]),$_title_backupsource)."(No.$get[age])";
-			$backupdata = join("",get_backup($get[age],encode($get["page"]).".txt"));
+			$backupdata = htmlspecialchars(join("",get_backup($get[age],encode($get["page"]).".txt")));
 			
 			$body.="</ul>\n<pre>\n$backupdata</pre>\n";
 		}