Changeset 4027 for trunk/CommentPlugin/lib/Foswiki/Plugins/CommentPlugin.pm

Timestamp:

06/04/09 00:10:06 (3 years ago)

Author:

KennethLavrsen

Message:

Item1640: CommentPlugin writes "%" as html-code, which prevents the use of Macros
It was me that created the problem with my default safe mode in URLPARAM
I have analysed the problem and as long as we use URLPARAM in the OUTPUT part of
the CommentPlugin templates and keep the settings inside verbatim tags we do not
expose any XSS attack. So we can give the users back the ability to use Foswiki
Macros in comment input fields.
With this I also merge over some code changes Crawford had done in trunk.
Note that except for the release version all changes in the .pm files are unrelated
to the bug fix, which is why I dare checking in perltidy stuff with a bug fix.
CommentPlugin is now again same in trunk and Release branch

File:

• trunk/CommentPlugin/lib/Foswiki/Plugins/CommentPlugin.pm (modified) (5 diffs)

trunk/CommentPlugin/lib/Foswiki/Plugins/CommentPlugin.pm

@@ -13 +13 @@
 
 our $VERSION = '$Rev$';
-our $RELEASE = 'Foswiki-1.0.1';
+our $RELEASE = '04 Jun 2009';
 our $SHORTDESCRIPTION =
   'Quickly post comments to a page without an edit/preview/save cycle';
@@ -19 +19 @@
 
 sub initPlugin {
-
     #my ( $topic, $web, $user, $installWeb ) = @_;
     return 1;
@@ -30 +29 @@
 
     my $query = Foswiki::Func::getCgiQuery();
-    return unless ( defined($query) );
+    return unless( defined( $query ) );
 
     return unless $_[0] =~ m/%COMMENT({.*?})?%/o;
@@ -39 +38 @@
     # SMELL: unreliable
     my $previewing = ( $scriptname =~ /\/(preview|gnusave|rdiff|compare)/ );
-    Foswiki::Plugins::CommentPlugin::Comment::prompt( $previewing, $_[0], $web,
-        $topic );
+    Foswiki::Plugins::CommentPlugin::Comment::prompt( $previewing,
+                                                    $_[0], $web, $topic );
 }
 
 sub beforeSaveHandler {
-
     #my ( $text, $topic, $web ) = @_;
 
@@ -54 +52 @@
     my $action = $query->param('comment_action');
 
-    return unless ( defined($action) && $action eq 'save' );
-    Foswiki::Plugins::CommentPlugin::Comment::save(@_);
+    return unless( defined( $action ) && $action eq 'save' );
+    Foswiki::Plugins::CommentPlugin::Comment::save( @_ );
 }