--- HeadlinesPlugin.pm2 2004-10-29 21:43:03.000000000 -0700
+++ HeadlinesPlugin.pm  2004-10-31 23:02:53.000000000 -0800
@@ -44,7 +44,7 @@
         $perlDigestMD5Found
     );

-$VERSION = '1.002';
+$VERSION = '1.003';
 $perlDigestMD5Found = 0;

 # =========================
@@ -98,18 +98,16 @@
 {
     my( $theUrl, $theRefresh ) = @_;

-    my $cacheFilename = "";
+    my $cacheDir = "";
+    my $cacheFile = "";
     if( $theRefresh ) {
-        $cacheFilename = TWiki::Func::getPubDir() . '/' . $installWeb . '/HeadlinesPlugin';
-        unless( -e $cacheFilename ) {
-            # create the cache directory in the pub dir of the HeadlinesPlugin
-            umask( 002 );
-            mkdir( $cacheFilename, 0775 );
-        }
-        $cacheFilename .= '/_rss-' . Digest::MD5::md5_hex( $theUrl );
-        if( ( -e $cacheFilename ) && ( ( time() - (stat(_))[9] ) <= ( $theRefresh * 60 ) ) ) {
+        $cacheDir  = TWiki::Func::getPubDir() . '/' . $installWeb . '/HeadlinesPlugin';
+        $cacheDir  =~ /(.*)/;  $cacheDir  = $1; # untaint (save because only internal variables)
+        $cacheFile = $cacheDir . '/_rss-' . Digest::MD5::md5_hex( $theUrl );
+        $cacheFile =~ /(.*)/;  $cacheFile = $1; # untaint
+        if( ( -e $cacheFile ) && ( ( time() - (stat(_))[9] ) <= ( $theRefresh * 60 ) ) ) {
             # return cached version if it exists and isn't too old. 1440 = 24h * 60min
-            return TWiki::Func::readFile( $cacheFilename );
+            return TWiki::Func::readFile( $cacheFile );
         }
     }

@@ -145,8 +143,13 @@
     $text =~ s/ +/ /gos;

     if( $theRefresh ) {
+        unless( -e $cacheDir ) {
+            # create the cache directory in the pub dir of the HeadlinesPlugin
+            umask( 002 );
+            mkdir( $cacheDir, 0775 );
+        }
         # save text in cache file before returning it
-        TWiki::Func::saveFile( $cacheFilename, $text );
+        TWiki::Func::saveFile( $cacheFile, $text );
     }

     return $text;