From: Jean-Philippe Lang <jp_lang@yahoo.fr>
Date: Sat, 18 Aug 2012 12:35:14 +0000 (+0000)
Subject: Validate macro name and options.
X-Git-Tag: 2.1.0~121
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=29d54f5d501af62760d197396a13b018f246e2b6;p=redmine.git

Validate macro name and options.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@10211 e93f8b46-1217-0410-a6f0-8f06a7374b81
---

diff --git a/lib/redmine/wiki_formatting/macros.rb b/lib/redmine/wiki_formatting/macros.rb
index 16a3239ee..a4e43da47 100644
--- a/lib/redmine/wiki_formatting/macros.rb
+++ b/lib/redmine/wiki_formatting/macros.rb
@@ -125,10 +125,16 @@ module Redmine
         #     # args is a string
         #   end
         def macro(name, options={}, &block)
+          options.assert_valid_keys(:desc, :parse_args)
+          unless name.to_s.match(/\A\w+\z/)
+            raise "Invalid macro name: #{name} (only 0-9, A-Z, a-z and _ characters are accepted)"
+          end
+          unless block_given?
+            raise "Can not create a macro without a block!"
+          end
           name = name.to_sym if name.is_a?(String)
           available_macros[name] = {:desc => @@desc || ''}.merge(options)
           @@desc = nil
-          raise "Can not create a macro without a block!" unless block_given?
           Definitions.send :define_method, "macro_#{name}".downcase, &block
         end