BugTrack/2557 Fix touchgraph plugin Moji-bake

[pukiwiki/pukiwiki.git] / plugin / newpage.inc.php

diff --git a/plugin/newpage.inc.php b/plugin/newpage.inc.php
index 7de5377..3b55906 100644 (file)
--- a/plugin/newpage.inc.php
+++ b/plugin/newpage.inc.php
@@ -1,23 +1,34 @@
 <?php
-// $Id: newpage.inc.php,v 1.13 2005/01/02 06:56:46 henoheno Exp $
+// PukiWiki - Yet another WikiWikiWeb clone.
+// newpage.inc.php
+// Copyright 2002-2017 PukiWiki Development Team
+// License: GPL v2 or (at your option) any later version
+//
+// Newpage plugin
 
 function plugin_newpage_convert()
 {
-       global $script, $vars, $_btn_edit, $_msg_newpage, $BracketName;
+       global $vars, $_btn_edit, $_msg_newpage, $BracketName;
+       static $id = 0;
+
+       $script = get_base_uri();
+       if (PKWK_READONLY) return ''; // Show nothing
 
        $newpage = '';
        if (func_num_args()) list($newpage) = func_get_args();
        if (! preg_match('/^' . $BracketName . '$/', $newpage)) $newpage = '';
 
-       $s_page    = htmlspecialchars(isset($vars['refer']) ? $vars['refer'] : $vars['page']);
-       $s_newpage = htmlspecialchars($newpage);
+       $s_page    = htmlsc(isset($vars['refer']) ? $vars['refer'] : $vars['page']);
+       $s_newpage = htmlsc($newpage);
+       ++$id;
+
        $ret = <<<EOD
 <form action="$script" method="post">
  <div>
   <input type="hidden" name="plugin" value="newpage" />
   <input type="hidden" name="refer"  value="$s_page" />
-  $_msg_newpage:
-  <input type="text"   name="page"   value="$s_newpage" size="30" />
+  <label for="_p_newpage_$id">$_msg_newpage:</label>
+  <input type="text"   name="page" id="_p_newpage_$id" value="$s_newpage" size="30" />
   <input type="submit" value="$_btn_edit" />
  </div>
 </form>
@@ -30,6 +41,8 @@ function plugin_newpage_action()
 {
        global $vars, $_btn_edit, $_msg_newpage;
 
+       if (PKWK_READONLY) die_message('PKWK_READONLY prohibits editing');
+
        if ($vars['page'] == '') {
                $retvars['msg']  = $_msg_newpage;
                $retvars['body'] = plugin_newpage_convert();
@@ -41,9 +54,8 @@ function plugin_newpage_action()
                $r_refer = rawurlencode($vars['refer']);
 
                pkwk_headers_sent();
-               header('Location: ' . get_script_uri() .
+               header('Location: ' . get_base_uri(PKWK_URI_ROOT) .
                        '?cmd=read&page=' . $r_page . '&refer=' . $r_refer);
                exit;
        }
 }
-?>