BugTrack/485 : get_interwiki_url()関数内ではhtmlspecialchars()を通さないように

diff --git a/make_link.php b/make_link.php
index cf612f1..15df59b 100644 (file)
--- a/make_link.php
+++ b/make_link.php
@@ -2,7 +2,7 @@
 /////////////////////////////////////////////////
 // PukiWiki - Yet another WikiWikiWeb clone.
 //
-// $Id: make_link.php,v 1.61 2003/11/05 11:05:09 arino Exp $
+// $Id: make_link.php,v 1.62 2003/11/07 03:12:05 arino Exp $
 //
 
 // ¥ê¥ó¥¯¤òÉղ乤ë
@@ -447,11 +447,10 @@ EOD;
                {
                        list(,$this->param,$this->anchor) = $matches;
                }
-               $this->url = get_interwiki_url($name,$this->param);
-               if ($this->url === FALSE)
-               {
-                       $this->url = $script.'?'.rawurlencode('[['.$name.':'.$this->param.']]');
-               }
+               $url = get_interwiki_url($name,$this->param);
+               $this->url = ($url === FALSE) ?
+                       $script.'?'.rawurlencode('[['.$name.':'.$this->param.']]') :
+                       htmlspecialchars($url);
                
                return parent::setParam(
                        $page,
@@ -802,7 +801,7 @@ function get_interwiki_url($name,$param)
                {
                        if (preg_match('/\[((?:(?:https?|ftp|news):\/\/|\.\.?\/)[!~*\'();\/?:\@&=+\$,%#\w.-]*)\s([^\]]+)\]\s?([^\s]*)/',$line,$matches))
                        {
-                               $interwikinames[$matches[2]] = array(htmlspecialchars($matches[1]),$matches[3]);
+                               $interwikinames[$matches[2]] = array($matches[1],$matches[3]);
                        }
                }
        }
@@ -821,7 +820,7 @@ function get_interwiki_url($name,$param)
                        {
                                $param = '[['.mb_convert_encoding($param,'SJIS',SOURCE_ENCODING).']]';
                        }
-                       $param = htmlspecialchars($param);
+//                     $param = htmlspecialchars($param);
                        break;
                
                // moin·Ï
@@ -838,7 +837,7 @@ function get_interwiki_url($name,$param)
                // URL¥¨¥ó¥³¡¼¥É¤·¤Ê¤¤
                case 'asis':
                case 'raw':
-                       $param = htmlspecialchars($param);
+//                     $param = htmlspecialchars($param);
                        break;
                
                default:

diff --git a/plugin/lookup.inc.php b/plugin/lookup.inc.php
index c8cc5f4..0f529bd 100644 (file)
--- a/plugin/lookup.inc.php
+++ b/plugin/lookup.inc.php
@@ -1,5 +1,5 @@
 <?php
-// $Id: lookup.inc.php,v 1.8 2003/02/28 03:19:55 panda Exp $
+// $Id: lookup.inc.php,v 1.9 2003/11/07 03:12:05 arino Exp $
 
 function plugin_lookup_convert()
 {
@@ -34,13 +34,15 @@ EOD;
 }
 function plugin_lookup_action()
 {
-       global $script,$vars;
-       
-       if (!$vars['inter'] or !$vars['page']) return;
+       global $vars;
        
-       $interwikiname = rawurlencode("[[{$vars['inter']}:{$vars['page']}]]");
+       $url = get_interwiki_url($vars['inter'],$vars['page']);
+       if ($url === FALSE)
+       {
+               return;
+       }
        
-       header("Location: $script?$interwikiname");
+       header("Location: $url");
        die();
 }
 ?>