BugTrack/2062 Remove Referer function config default page

[pukiwiki/pukiwiki.git] / plugin / diff.inc.php

diff --git a/plugin/diff.inc.php b/plugin/diff.inc.php
index d45698d..c9fd509 100644 (file)
--- a/plugin/diff.inc.php
+++ b/plugin/diff.inc.php
@@ -1,6 +1,6 @@
 <?php
 // PukiWiki - Yet another WikiWikiWeb clone.
-// $Id: diff.inc.php,v 1.17 2005/12/10 10:36:17 henoheno Exp $
+// $Id: diff.inc.php,v 1.20 2011/01/25 15:01:01 henoheno Exp $
 // Copyright (C)
 //   2002-2005 PukiWiki Developers Team
 //   2002      Originally written by yu-ji
@@ -29,8 +29,8 @@ function plugin_diff_view($page)
        global $_msg_notfound, $_msg_goto, $_msg_deleted, $_msg_addline, $_msg_delline, $_title_diff;
        global $_title_diff_delete;
 
-       $r_page = rawurlencode($page);
-       $s_page = htmlspecialchars($page);
+       $r_page = pagename_urlencode($page);
+       $s_page = htmlsc($page);
 
        $menu = array(
                '<li>' . $_msg_addline . '</li>',
@@ -47,21 +47,13 @@ function plugin_diff_view($page)
 
        $filename = DIFF_DIR . encode($page) . '.txt';
        if (file_exists($filename)) {
-               $diffdata = htmlspecialchars(join('', file($filename)));
-
-               // Cut diff markers ('+' or '-' or ' ')
-               $diffdata = preg_replace('/^\-(.*)$/m', '<span class="diff_removed">$1</span>', $diffdata);
-               $diffdata = preg_replace('/^\+(.*)$/m', '<span class="diff_added"  >$1</span>', $diffdata);
-               $diffdata = preg_replace('/^ (.*)$/m',  '$1', $diffdata);
-
                if (! PKWK_READONLY) {
                        $menu[] = '<li><a href="' . $script . '?cmd=diff&amp;action=delete&amp;page=' .
                                $r_page . '">' . str_replace('$1', $s_page, $_title_diff_delete) . '</a></li>';
                }
-
-               $msg = '<pre>' . $diffdata . '</pre>' . "\n";
+               $msg = '<pre>' . diff_style_to_css(htmlsc(join('', file($filename)))) . '</pre>' . "\n";
        } else if ($is_page) {
-               $diffdata = trim(htmlspecialchars(join('', get_source($page))));
+               $diffdata = trim(htmlsc(join('', get_source($page))));
                $msg = '<pre><span class="diff_added">' . $diffdata . '</span></pre>' . "\n";
        } else {
                return array('msg'=>$_title_diff, 'body'=>$_msg_notfound);
@@ -102,7 +94,7 @@ function plugin_diff_delete($page)
                }
        }
 
-       $s_page = htmlspecialchars($page);
+       $s_page = htmlsc($page);
        $body .= <<<EOD
 <p>$_msg_diff_adminpass</p>
 <form action="$script" method="post">
@@ -118,4 +110,4 @@ EOD;
 
        return array('msg'=>$_title_diff_delete, 'body'=>$body);
 }
-?>
+