From 211759a4894488fd8c266534bc318f2be9c940f5 Mon Sep 17 00:00:00 2001
From: panda <panda>
Date: Fri, 28 Feb 2003 11:45:23 +0900
Subject: [PATCH] BugTrack/229 - fix XSS vulnerability.

---
 plugin/calendar.inc.php | 51 +++++++++++++++++++++++--------------------------
 1 file changed, 24 insertions(+), 27 deletions(-)

diff --git a/plugin/calendar.inc.php b/plugin/calendar.inc.php
index a3c073a..fd0de4a 100644
--- a/plugin/calendar.inc.php
+++ b/plugin/calendar.inc.php
@@ -1,5 +1,5 @@
 <?php
-// $Id: calendar.inc.php,v 1.11 2003/01/27 05:38:44 panda Exp $
+// $Id: calendar.inc.php,v 1.12 2003/02/28 02:45:23 panda Exp $
 
 function plugin_calendar_convert()
 {
@@ -7,25 +7,24 @@ function plugin_calendar_convert()
 	
 	$args = func_get_args();
 	
-	if (func_num_args() == 0)
-	{
-		$date_str = get_date("Ym");
-		$pre = $vars['page'];
-		$prefix = preg_replace("/^\[\[(.*)\]\]$/","$1",$vars['page'])."/";
-	}
-	else if (func_num_args() == 1)
+	$date_str = get_date("Ym");
+	$pre = $vars['page'];
+	$prefix = preg_replace("/^\[\[(.*)\]\]$/","$1",$vars['page'])."/";
+	
+	if (func_num_args() == 1)
 	{
 		if (is_numeric($args[0]) && strlen($args[0]) == 6)
 		{
 			$date_str = $args[0];
-			$pre = $vars['page'];
-			$prefix = preg_replace("/^\[\[(.*)\]\]$/","$1",$vars['page'])."/";
 		}
 		else
 		{
-			$date_str = get_date("Ym");
-			$pre = $args[0];
-			$prefix = $args[0]."/";
+			$page = get_fullname(strip_bracket($args[0]));
+			if (is_pagename($page))
+			{
+				$pre = $page;
+				$prefix = $page.'/';
+			}
 		}
 	}
 	else if (func_num_args() == 2)
@@ -33,25 +32,23 @@ function plugin_calendar_convert()
 		if (is_numeric($args[0]) && strlen($args[0]) == 6)
 		{
 			$date_str = $args[0];
-			$pre = $args[1];
-			$prefix = $args[1]."/";
+			$page = get_fullname(strip_bracket($args[1]));
+			if (is_pagename($page))
+			{
+				$pre = $page;
+				$prefix = $page.'/';
+			}
 		}
 		else if (is_numeric($args[1]) && strlen($args[1]) == 6)
 		{
 			$date_str = $args[1];
-			$pre = $args[0];
-			$prefix = $args[0]."/";
+			$page = get_fullname(strip_bracket($args[0]));
+			if (is_pagename($page))
+			{
+				$pre = $page;
+				$prefix = $page.'/';
+			}
 		}
-		else
-		{
-			$date_str = get_date("Ym");
-			$pre = $vars['page'];
-			$prefix = preg_replace("/^\[\[(.*)\]\]$/","$1",$vars['page'])."/";
-		}
-	}
-	else
-	{
-		return FALSE;
 	}
 
 	if (!$command) $cmd = "read";
-- 
2.11.0