urosm
/
ikiwiki
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

oh, this is confusing, it needs escaping in <title>, but not when it's used 

inline, already escaped there
master
joey 2007-03-21 06:22:06 +00:00
parent 1c65ca4922
commit 03e5438155
5 changed files with 7 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
debian/changelog vendored
View File

@ -12,9 +12,8 @@ ikiwiki (1.46) unstable; urgency=low
same time, and let the second person resolve the conflict. same time, and let the second person resolve the conflict.
* Applied a patch from Michał to make the mercurial backend pass --quiet to * Applied a patch from Michał to make the mercurial backend pass --quiet to
hg. hg.
* Fix a few bugs around page titles containing html. The worst of these * Fix a security hole that allowed a web user to insert
is an actual security hole as it allows insertion of html into the title arbitrary html in the title of a page due to missing escaping.
element of a page, which is not processed by the htmlscrubber.
-- Joey Hess <joeyh@debian.org> Wed, 21 Mar 2007 01:51:30 -0400 -- Joey Hess <joeyh@debian.org> Wed, 21 Mar 2007 01:51:30 -0400

2
po/ikiwiki.pot
View File

@ -8,7 +8,7 @@ msgid ""
msgstr "" msgstr ""
"Project-Id-Version: PACKAGE VERSION\n" "Project-Id-Version: PACKAGE VERSION\n"
"Report-Msgid-Bugs-To: \n" "Report-Msgid-Bugs-To: \n"
"POT-Creation-Date: 2007-03-21 01:50-0400\n" "POT-Creation-Date: 2007-03-21 02:05-0400\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n" "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: LANGUAGE <LL@li.org>\n" "Language-Team: LANGUAGE <LL@li.org>\n"

2
templates/archivepage.tmpl
View File

@ -1,5 +1,5 @@
<p> <p>
<a href="<TMPL_VAR PAGEURL>"><TMPL_VAR TITLE ESCAPE=HTML></a><br /> <a href="<TMPL_VAR PAGEURL>"><TMPL_VAR TITLE></a><br />
<i> <i>
Posted <TMPL_VAR CTIME> Posted <TMPL_VAR CTIME>
</i> </i>

4
templates/inlinepage.tmpl
View File

@ -10,9 +10,9 @@
</TMPL_IF> </TMPL_IF>
<span class="header"> <span class="header">
<TMPL_IF NAME="PERMALINK"> <TMPL_IF NAME="PERMALINK">
<a href="<TMPL_VAR PERMALINK>"><TMPL_VAR TITLE ESCAPE=HTML></a> <a href="<TMPL_VAR PERMALINK>"><TMPL_VAR TITLE></a>
<TMPL_ELSE> <TMPL_ELSE>
<a href="<TMPL_VAR PAGEURL>"><TMPL_VAR TITLE ESCAPE=HTML></a> <a href="<TMPL_VAR PAGEURL>"><TMPL_VAR TITLE></a>
</TMPL_IF> </TMPL_IF>
</span> </span>
<TMPL_VAR CONTENT> <TMPL_VAR CONTENT>

2
templates/titlepage.tmpl
View File

@ -1 +1 @@
<p><a href="<TMPL_VAR PAGEURL>"><TMPL_VAR TITLE ESCAPE=HTML></a></p> <p><a href="<TMPL_VAR PAGEURL>"><TMPL_VAR TITLE></a></p>