From 22839e48d013abdc46b609cd50b45b3bce6626f9 Mon Sep 17 00:00:00 2001 From: zotlabs Date: Thu, 26 Jan 2017 15:16:41 -0800 Subject: better handling of html special chars in wiki and wikipage names --- Zotlabs/Module/Wiki.php | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) (limited to 'Zotlabs/Module/Wiki.php') diff --git a/Zotlabs/Module/Wiki.php b/Zotlabs/Module/Wiki.php index 2ba4df209..5397deebe 100644 --- a/Zotlabs/Module/Wiki.php +++ b/Zotlabs/Module/Wiki.php @@ -189,8 +189,8 @@ class Wiki extends \Zotlabs\Web\Controller { // GET /wiki/channel/wiki/page // Fetch the wiki info and determine observer permissions - $wikiUrlName = urlencode(argv(2)); - $pageUrlName = urlencode(argv(3)); + $wikiUrlName = urldecode(argv(2)); + $pageUrlName = urldecode(argv(3)); $w = Zlib\NativeWiki::exists_by_name($owner['channel_id'], $wikiUrlName); @@ -345,11 +345,11 @@ class Wiki extends \Zotlabs\Web\Controller { } $wiki = array(); // Generate new wiki info from input name - $wiki['postVisible'] = ((intval($_POST['postVisible']) === 0) ? 0 : 1); - $wiki['rawName'] = $_POST['wikiName']; - $wiki['htmlName'] = escape_tags($_POST['wikiName']); - $wiki['urlName'] = urlencode($_POST['wikiName']); - $wiki['mimeType'] = $_POST['mimeType']; + $wiki['postVisible'] = ((intval($_POST['postVisible'])) ? 1 : 0); + $wiki['rawName'] = $_POST['wikiName']; + $wiki['htmlName'] = escape_tags($_POST['wikiName']); + $wiki['urlName'] = urlencode(urlencode($_POST['wikiName'])); + $wiki['mimeType'] = $_POST['mimeType']; if($wiki['urlName'] === '') { notice( t('Error creating wiki. Invalid name.') . EOL); @@ -367,6 +367,7 @@ class Wiki extends \Zotlabs\Web\Controller { notice( t('Wiki created, but error creating Home page.')); goaway(z_root() . '/wiki/' . $nick . '/' . $wiki['urlName']); } + Zlib\NativeWiki::sync_a_wiki_item($owner['channel_id'],$homePage['item_id'],$r['item']['resource_id']); goaway(z_root() . '/wiki/' . $nick . '/' . $wiki['urlName'] . '/' . $homePage['page']['urlName']); } else { @@ -427,10 +428,10 @@ class Wiki extends \Zotlabs\Web\Controller { if($commit['success']) { Zlib\NativeWiki::sync_a_wiki_item($owner['channel_id'],$commit['item_id'],$resource_id); - json_return_and_die(array('url' => '/' . argv(0) . '/' . argv(1) . '/' . $page['wiki']['urlName'] . '/' . $page['page']['urlName'], 'success' => true)); + json_return_and_die(array('url' => '/' . argv(0) . '/' . argv(1) . '/' . urlencode($page['wiki']['urlName']) . '/' . urlencode($page['page']['urlName']), 'success' => true)); } else { - json_return_and_die(array('message' => 'Error making git commit','url' => '/' . argv(0) . '/' . argv(1) . '/' . $page['wiki']['urlName'] . '/' . urlencode($page['page']['urlName']),'success' => false)); + json_return_and_die(array('message' => 'Error making git commit','url' => '/' . argv(0) . '/' . argv(1) . '/' . urlencode($page['wiki']['urlName']) . '/' . urlencode($page['page']['urlName']),'success' => false)); } -- cgit v1.2.3