Fix stored XSS vulnerability via do=export_metadata dokuwiki#4305

This prevents metadata export in general and also ensures the the
temporary $doc property in the metadata renderer is cleared in
document_end

Author: kazmiya

inc/Action/Export.php

@@ -86,6 +86,9 @@ public function preProcess()
                 $headers['Content-Type'] = 'text/html; charset=utf-8';
                 $output = p_wiki_xhtml($ID, $REV, false);
                 break;
+            case 'metadata':
+                // metadata should not be exported
+                break;
             default:
                 $output = p_cached_output(wikiFN($ID, $REV), $mode, $ID);
                 $headers = p_get_metadata($ID, "format $mode");

inc/parser/metadata.php

@@ -108,6 +108,8 @@ public function document_end()
         if (!isset($this->meta['date']['modified'])) {
             $this->meta['date']['modified'] = filemtime(wikiFN($ID));
         }
+
+        $this->doc = '';
     }
 
     /**