htmlsc(): Just sugar for htmlspecialchars(), and a foundation

[pukiwiki/pukiwiki.git] / lib / pukiwiki.php

diff --git a/lib/pukiwiki.php b/lib/pukiwiki.php
index 21d8c46..b4c4e16 100644 (file)
--- a/lib/pukiwiki.php
+++ b/lib/pukiwiki.php
@@ -1,9 +1,9 @@
 <?php
 // PukiWiki - Yet another WikiWikiWeb clone.
-// $Id: pukiwiki.php,v 1.17 2007/02/11 05:53:30 henoheno Exp $
+// $Id: pukiwiki.php,v 1.23 2011/01/25 15:01:01 henoheno Exp $
 //
 // PukiWiki 1.4.*
-//  Copyright (C) 2002-2006 by PukiWiki Developers Team
+//  Copyright (C) 2002-2007 by PukiWiki Developers Team
 //  http://pukiwiki.sourceforge.jp/
 //
 // PukiWiki 1.3.*
@@ -71,13 +71,10 @@ $page  = isset($vars['page'])  ? $vars['page']  : '';
 $refer = isset($vars['refer']) ? $vars['refer'] : '';
 
 if (isset($vars['cmd'])) {
-       $base   = $page;
        $plugin = & $vars['cmd'];
 } else if (isset($vars['plugin'])) {
-       $base   =  $refer;
        $plugin = & $vars['plugin'];
 } else {
-       $base   =  $refer;
        $plugin = '';
 }
 
@@ -86,12 +83,16 @@ if ($spam && $method != 'GET') {
        // Adjustment
        $_spam   = ! empty($spam);
        $_plugin = strtolower($plugin);
+       $_ignore = array();
+
        switch ($_plugin) {
                case 'search': $_spam = FALSE; break;
                case 'edit':
                        $_page = & $page;
                        if (isset($vars['add']) && $vars['add']) {
                                $_plugin = 'add';
+                       } else {
+                               $_ignore[] = 'original';
                        }
                        break;
                case 'bugtrack': $_page = & $vars['base'];  break;
@@ -99,8 +100,10 @@ if ($spam && $method != 'GET') {
                case 'read':     $_page = & $page;  break;
                default: $_page = & $refer; break;
        }
+
        if ($_spam) {
                require(LIB_DIR . 'spam.php');
+
                if (isset($spam['method'][$_plugin])) {
                        $_method = & $spam['method'][$_plugin];
                } else if (isset($spam['method']['_default'])) {
@@ -109,24 +112,45 @@ if ($spam && $method != 'GET') {
                        $_method = array();
                }
                $exitmode = isset($spam['exitmode']) ? $spam['exitmode'] : '';
-               pkwk_spamfilter($method . ' to #' . $_plugin, $_page, $vars, $_method, $exitmode);
+
+               // Hack: ignorance several keys
+               if ($_ignore) {
+                       $_vars = array();
+                       foreach($vars as $key => $value) {
+                               $_vars[$key] = & $vars[$key];
+                       }
+                       foreach($_ignore as $key) {
+                               unset($_vars[$key]);
+                       }
+               } else {
+                       $_vars = & $vars;
+               }
+
+               pkwk_spamfilter($method . ' to #' . $_plugin, $_page, $_vars, $_method, $exitmode);
        }
 }
 
 // Plugin execution
 if ($plugin != '') {
-       if (! exist_plugin_action($plugin)) {
-               $msg = 'plugin=' . htmlspecialchars($plugin) . ' is not implemented.';
-               $retvars = array('msg'=>$msg,'body'=>$msg);
-               $base    = & $defaultpage;
-       } else {
+       if (exist_plugin_action($plugin)) {
                $retvars = do_plugin_action($plugin);
                if ($retvars === FALSE) exit; // Done
+
+               // Rescan $vars (Some plugins rewrite it)
+               if (isset($vars['cmd'])) {
+                       $base = isset($vars['page'])  ? $vars['page']  : '';
+               } else {
+                       $base = isset($vars['refer']) ? $vars['refer'] : '';
+               }
+       } else {
+               $msg = 'plugin=' . htmlsc($plugin) . ' is not implemented.';
+               $retvars = array('msg'=>$msg,'body'=>$msg);
+               $base    = & $defaultpage;
        }
 }
 
 // Page output
-$title = htmlspecialchars(strip_bracket($base));
+$title = htmlsc(strip_bracket($base));
 $page  = make_search($base);
 if (isset($retvars['msg']) && $retvars['msg'] != '') {
        $title = str_replace('$1', $title, $retvars['msg']);
@@ -138,7 +162,7 @@ if (isset($retvars['body']) && $retvars['body'] != '') {
 } else {
        if ($base == '' || ! is_page($base)) {
                $base  = & $defaultpage;
-               $title = htmlspecialchars(strip_bracket($base));
+               $title = htmlsc(strip_bracket($base));
                $page  = make_search($base);
        }