only allow configured URL schemes in external links

This fixes a problem where JavaScript could be introduced through
specially crafted RSS feeds on a lower level than the commit from
yesterday (1ca

only allow configured URL schemes in external links

This fixes a problem where JavaScript could be introduced through
specially crafted RSS feeds on a lower level than the commit from
yesterday (1ca2719c7488662ebd7964c0d026e0890f923ee9)

This also fixes a problem where JavaScript links could be introduced by
specifying it as an RSS URL: the resulting error message displays a
link to the broken feed URL. This patch makes sure there's no working
link for unknown protocols.

show more ...

Only allow known protocols in RSS links

This fixes a security vulnerability where an attacker could introduce
JavaScript links into wiki pages by including a prepared RSS feed.

Change when metadata is rendered - only when really needed

This changes the cache logic for metadata. It introduces a new mode that
tries to avoid rendering the page again for simple requests but st

Change when metadata is rendered - only when really needed

This changes the cache logic for metadata. It introduces a new mode that
tries to avoid rendering the page again for simple requests but still
updates the metadata when the page has been changed (but not when the
cache timeout has been reached or purge is used). It simply compares the
time of the last rendering with the last modified time of the page.

The old boolean $render parameter has been changed into an int with
three possible values. Compatibility for the old parameter is provided
using a check with is_numeric using the following mapping:
- false is still don't render (0 is the new value for that)
- true is using that new render logic which means that many plugins will
still work unchanged even if they request a lot of data using
$render=true (1 is the new value for that providing full compatibility
in the case 1 has been used instead of true)

The default value for p_get_first_heading is now that new simple cache
logic, the default value for getting metadata is the cache logic which
should be used with care but is the only way to request (rendered)
metadata that can change because of plugin installations or upgrades.

show more ...

Support the empty link [[]]

Check if link exists and set right caption

Make the regex for internal links more restrictive

This fixes a PCRE backtrack error that occurred on large pages like
:users on dokuwiki.org.

Revert "merged branch 'danny0838:rewrite_block' and resolved conflict"

Anika's merge did not pul in the individual patches as one would expect.

Then I messed up when trying to fix this by merging w

Revert "merged branch 'danny0838:rewrite_block' and resolved conflict"

Anika's merge did not pul in the individual patches as one would expect.

Then I messed up when trying to fix this by merging with danny's repo
again but used the wrong branch. So we're still missing two patches. To
have them apply cleanly I have to revert Anika's merge here. Another
merge for the missing two patches will follow.

This reverts commit b17e20ac9cca30b612968d02f06fa9c5df5c01f0.

show more ...

merged branch 'danny0838:rewrite_block' and resolved conflict

FS#2154 unset call writers in finalise() to prevent circular references
and help PHP garbage collection for PHP < 5.3

make IPv6 links in link syntax FS#2137

URLs may contain brackets [] FS#2137

Major rework of rewrite block in handler.php. (FS#2145)

-Simplify the algorithm. May improve performance.
-Treat footnote as pure block and section as pure stack.
-Remove post-p-open and pre-p-close

Major rework of rewrite block in handler.php. (FS#2145)

-Simplify the algorithm. May improve performance.
-Treat footnote as pure block and section as pure stack.
-Remove post-p-open and pre-p-close linefeeds. Affects the effect of xbr plugin.

show more ...

First attempt to improve rewrite blocks; also eliminates post-paragraph starting single linebreaks.

Fixes an issue of metadata missing on links with empty altname. FS#2144

Like others, there's no need to define $sectionedits as private, and it prevents plugins that ought to handle headers from working and require a lot of ugly workarounds (such as header2).

If there's

Like others, there's no need to define $sectionedits as private, and it prevents plugins that ought to handle headers from working and require a lot of ugly workarounds (such as header2).

If there's a concern, "protected" may be another choice.

show more ...

removed obsolete references to 'JSnocheck' class

skip empty image title from abstract

store the creator's login name in metadata FS#1397

Make baseonly work in allowedModes

This makes it possible to have modes that do accept headers
(baseonly) in the parser.

Related test cases are still running through but I'm not 100% sure
I did not

Make baseonly work in allowedModes

This makes it possible to have modes that do accept headers
(baseonly) in the parser.

Related test cases are still running through but I'm not 100% sure
I did not break something here. So it should be tested a bit more.

This patch will allow plugins to wrap multiple sections, however it
also makes it possible to easily break XHTML validity, because
headers also open and close sections, so plugin authors need to be
aware!

In case you wonder: this patch is not about allowing formatting
inside headers.

show more ...

Remove enc=utf-8 in VIM modeline as it is not allowed in VIM 7.3

As of VIM 7.3 it is no longer possible to specify the encoding in the
modeline. This gives an error message whenever such a file is o

Remove enc=utf-8 in VIM modeline as it is not allowed in VIM 7.3

As of VIM 7.3 it is no longer possible to specify the encoding in the
modeline. This gives an error message whenever such a file is opened,
thus this commit removes the enc setting from the modeline.

show more ...

explaining what Doku_Parser_Mode_formatting does: it sets markup

give a description for a function

Improve compatibility of table instructions handling

FS#1995, add a little defense to avoid warnings caused by bad wiki
syntax

No need for a self include ;)