BugTrack/2062 Remove Referer function config default page

[pukiwiki/pukiwiki.git] / plugin / diff.inc.php

diff --git a/plugin/diff.inc.php b/plugin/diff.inc.php
index 4911318..c9fd509 100644 (file)
--- a/plugin/diff.inc.php
+++ b/plugin/diff.inc.php
@@ -1,11 +1,13 @@
 <?php
-/////////////////////////////////////////////////
 // PukiWiki - Yet another WikiWikiWeb clone.
+// $Id: diff.inc.php,v 1.20 2011/01/25 15:01:01 henoheno Exp $
+// Copyright (C)
+//   2002-2005 PukiWiki Developers Team
+//   2002      Originally written by yu-ji
+// License: GPL v2 or (at your option) any later version
 //
-// $Id: diff.inc.php,v 1.9 2004/07/18 10:38:54 henoheno Exp $
-//
+// Showing colored-diff plugin
 
-//¥Ú¡¼¥¸¤Îº¹Ê¬¤òɽ¼¨¤¹¤ë
 function plugin_diff_action()
 {
        global $vars;
@@ -16,47 +18,44 @@ function plugin_diff_action()
        $action = isset($vars['action']) ? $vars['action'] : '';
        switch ($action) {
                case 'delete': $retval = plugin_diff_delete($page);     break;
-               default:       $retval = plugin_diff_view($page);       break;                  
+               default:       $retval = plugin_diff_view($page);       break;
        }
        return $retval;
 }
 
-// º¹Ê¬¤òɽ¼¨
 function plugin_diff_view($page)
 {
        global $script, $hr;
        global $_msg_notfound, $_msg_goto, $_msg_deleted, $_msg_addline, $_msg_delline, $_title_diff;
        global $_title_diff_delete;
-       
-       $r_page = rawurlencode($page);
-       $s_page = htmlspecialchars($page);
-       
+
+       $r_page = pagename_urlencode($page);
+       $s_page = htmlsc($page);
+
        $menu = array(
-               "<li>$_msg_addline</li>",
-               "<li>$_msg_delline</li>"
+               '<li>' . $_msg_addline . '</li>',
+               '<li>' . $_msg_delline . '</li>'
        );
 
        $is_page = is_page($page);
        if ($is_page) {
-               $menu[] = ' <li>' . str_replace('$1', "<a href=\"$script?$r_page\">$s_page</a>", $_msg_goto) . '</li>';
+               $menu[] = ' <li>' . str_replace('$1', '<a href="' . $script . '?' . $r_page . '">' .
+                       $s_page . '</a>', $_msg_goto) . '</li>';
        } else {
-               $menu[] = ' <li>' . str_replace('$1', $s_page,$_msg_deleted) . '</li>';
+               $menu[] = ' <li>' . str_replace('$1', $s_page, $_msg_deleted) . '</li>';
        }
 
        $filename = DIFF_DIR . encode($page) . '.txt';
        if (file_exists($filename)) {
-               $diffdata = htmlspecialchars(join('', file($filename)));
-               $diffdata = preg_replace('/^(\-)(.*)$/m', '<span class="diff_removed"> $2</span>', $diffdata);
-               $diffdata = preg_replace('/^(\+)(.*)$/m', '<span class="diff_added"  > $2</span>', $diffdata);
-               $menu[] = "<li><a href=\"$script?cmd=diff&action=delete&page=$r_page\">" .
-                       str_replace('$1', $s_page, $_title_diff_delete) . '</a></li>';
-               $msg = "<pre>$diffdata</pre>\n";
-       }
-       else if ($is_page) {
-               $diffdata = trim(htmlspecialchars(join('', get_source($page))));
-               $msg = "<pre><span class=\"diff_added\">$diffdata</span></pre>\n";
-       }
-       else {
+               if (! PKWK_READONLY) {
+                       $menu[] = '<li><a href="' . $script . '?cmd=diff&amp;action=delete&amp;page=' .
+                               $r_page . '">' . str_replace('$1', $s_page, $_title_diff_delete) . '</a></li>';
+               }
+               $msg = '<pre>' . diff_style_to_css(htmlsc(join('', file($filename)))) . '</pre>' . "\n";
+       } else if ($is_page) {
+               $diffdata = trim(htmlsc(join('', get_source($page))));
+               $msg = '<pre><span class="diff_added">' . $diffdata . '</span></pre>' . "\n";
+       } else {
                return array('msg'=>$_title_diff, 'body'=>$_msg_notfound);
        }
 
@@ -71,19 +70,16 @@ EOD;
        return array('msg'=>$_title_diff, 'body'=>$body . $msg);
 }
 
-// ¥Ð¥Ã¥¯¥¢¥Ã¥×¤òºï½ü
 function plugin_diff_delete($page)
 {
-       error_reporting(E_ALL);
-
-       global $script, $vars, $adminpass;
+       global $script, $vars;
        global $_title_diff_delete, $_msg_diff_deleted;
        global $_msg_diff_adminpass, $_btn_delete, $_msg_invalidpass;
-       
-       $filename = DIFF_DIR . encode($page) . '.txt'; 
+
+       $filename = DIFF_DIR . encode($page) . '.txt';
        $body = '';
-       if (! is_pagename($page))     $body = "Invalid page name";
-       if (! file_exists($filename)) $body = make_pagelink($page) . "'s diff seems not found";
+       if (! is_pagename($page))     $body = 'Invalid page name';
+       if (! file_exists($filename)) $body = make_pagelink($page) . '\'s diff seems not found';
        if ($body) return array('msg'=>$_title_diff_delete, 'body'=>$body);
 
        if (isset($vars['pass'])) {
@@ -94,11 +90,11 @@ function plugin_diff_delete($page)
                                'body' => str_replace('$1', make_pagelink($page), $_msg_diff_deleted)
                        );
                } else {
-                       $body .= "<p><strong>$_msg_invalidpass</strong></p>\n";
+                       $body .= '<p><strong>' . $_msg_invalidpass . '</strong></p>' . "\n";
                }
        }
 
-       $s_page = htmlspecialchars($page);
+       $s_page = htmlsc($page);
        $body .= <<<EOD
 <p>$_msg_diff_adminpass</p>
 <form action="$script" method="post">
@@ -113,5 +109,5 @@ function plugin_diff_delete($page)
 EOD;
 
        return array('msg'=>$_title_diff_delete, 'body'=>$body);
-}      
-?>
+}
+