[pmwiki-users] Is a pagelist fmt supposed to be overridable via request=1?

[Petko Yotov]

On 13.11.2014 20:17, Randy Brown wrote:
> Maybe someday request=1 can be expanded for security to allow
> request="order,list,trail,PTV,if" or whatever specific parameters you
> want to be overridable via the URL. Or maybe someone will think of a
> better solution.

I committed to Subversion a change that would allow to define which 
request keys will be used or not as parameters. One could write:

   (:pagelist request=order,group:) allow only order and group to be 
replaced
   (:pagelist request=-fmt,-count:) disallow only fmt and count to be 
replaced
   (:pagelist request=1:) allow any parameter to be replaced (like now)

Note that up to 2.2.70, request=2, request=anything works like request=1 
(undocumented); if we decide to release the feature above, only 
request=1 will enable substitution (like documented).

This needs testing so please get the pagelist.php file, test the feature 
and report any problems.

Petko