BugTrack2/192, BugTrack2/229: Comment out: 1.3.x-compat replacement keywords

[pukiwiki/pukiwiki.git] / plugin / insert.inc.php

diff --git a/plugin/insert.inc.php b/plugin/insert.inc.php
index f3195f1..b19a181 100644 (file)
--- a/plugin/insert.inc.php
+++ b/plugin/insert.inc.php
@@ -1,5 +1,5 @@
 <?php
-// $Id: insert.inc.php,v 1.12 2005/01/23 07:34:39 henoheno Exp $
+// $Id: insert.inc.php,v 1.16 2011/01/25 15:01:01 henoheno Exp $
 //
 // Text inserting box plugin
 
@@ -12,6 +12,7 @@ function plugin_insert_action()
        global $script, $vars, $cols, $rows;
        global $_title_collided, $_msg_collided, $_title_updated;
 
+       if (PKWK_READONLY) die_message('PKWK_READONLY prohibits editing');
        if (! isset($vars['msg']) || $vars['msg'] == '') return;
 
        $vars['msg'] = preg_replace('/' . "\r" . '/', '', $vars['msg']);
@@ -37,11 +38,11 @@ function plugin_insert_action()
        $body = '';
        if (md5(@join('', get_source($vars['refer']))) != $vars['digest']) {
                $title = $_title_collided;
-               $body = $_msg_collided . "\n";
+               $body  = $_msg_collided . "\n";
 
-               $s_refer  = htmlspecialchars($vars['refer']);
-               $s_digest = htmlspecialchars($vars['digest']);
-               $s_postdata_input = htmlspecialchars($postdata_input);
+               $s_refer          = htmlsc($vars['refer']);
+               $s_digest         = htmlsc($vars['digest']);
+               $s_postdata_input = htmlsc($postdata_input);
 
                $body .= <<<EOD
 <form action="$script?cmd=preview" method="post">
@@ -71,15 +72,17 @@ function plugin_insert_convert()
        global $_btn_insert;
        static $numbers = array();
 
+       if (PKWK_READONLY) return ''; // Show nothing
+
        if (! isset($numbers[$vars['page']])) $numbers[$vars['page']] = 0;
 
        $insert_no = $numbers[$vars['page']]++;
 
-       $s_page   = htmlspecialchars($vars['page']);
-       $s_digest = htmlspecialchars($digest);
-       $s_cols = INSERT_COLS;
-       $s_rows = INSERT_ROWS;
-       $string = <<<EOD
+       $s_page   = htmlsc($vars['page']);
+       $s_digest = htmlsc($digest);
+       $s_cols   = INSERT_COLS;
+       $s_rows   = INSERT_ROWS;
+       $string   = <<<EOD
 <form action="$script" method="post">
  <div>
   <input type="hidden" name="insert_no" value="$insert_no" />