Mercurial > moin > 1.9
view MoinMoin/action/quicklink.py @ 5910:7e7e1cbb9d3f
security: fix remote code execution vulnerability in twikidraw/anywikidraw actions
We have wikiutil.taintfilename() to make user supplied filenames safe,
so that they can't contain any "special" characters like path separators, etc.
It is used at many places in moin, but wasn't used here. :|
author | Thomas Waldmann <tw AT waldmann-edv DOT de> |
---|---|
date | Sat, 29 Dec 2012 15:05:29 +0100 |
parents | a1322262398a |
children |
line wrap: on
line source
# -*- coding: iso-8859-1 -*- """ MoinMoin - add a quicklink to the user's quicklinks @copyright: 2000-2004 Juergen Hermann <jh@web.de>, 2006 MoinMoin:ThomasWaldmann @license: GNU GPL, see COPYING for details. """ from MoinMoin.Page import Page def execute(pagename, request): """ Add the current wiki page to the user quicklinks """ _ = request.getText if not request.user.valid: request.theme.add_msg(_("You must login to add a quicklink."), "error") elif not request.user.isQuickLinkedTo([pagename]): if request.user.addQuicklink(pagename): request.theme.add_msg(_('A quicklink to this page has been added for you.'), "info") else: # should not happen request.theme.add_msg(_('A quicklink to this page could not be added for you.'), "error") else: request.theme.add_msg(_('You already have a quicklink to this page.')) Page(request, pagename).send_page()