urosm
/
ikiwiki
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

more on the security hole

master
Joey Hess 2008-05-30 18:26:04 -04:00
parent 341296184d
commit 2bf2af30ea
2 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
doc/news/version_2.48.mdwn
View File

@ -1,3 +1,5 @@
**This release fixes an important security hole, upgrade immediately.**
News for ikiwiki 2.48: News for ikiwiki 2.48:
If you allowed password based logins to your wiki, those passwords were If you allowed password based logins to your wiki, those passwords were
@ -21,4 +23,4 @@ ikiwiki 2.48 released with [[toggle text="these changes"]]
* The password\_cost config setting is provided as a "more security" knob. * The password\_cost config setting is provided as a "more security" knob.
* teximg: Fix logurl. * teximg: Fix logurl.
* teximg: If the log isn't written, avoid ugly error messages. * teximg: If the log isn't written, avoid ugly error messages.
* Updated French translation. Closes: #[478530](http://bugs.debian.org/478530)"""]] * Updated French translation. Closes: #[478530](http://bugs.debian.org/478530)"""]]

10
doc/security.mdwn
View File

@ -397,3 +397,13 @@ with strong blowfish hashes.
You might also consider changing to [[plugins/openid]], which does not You might also consider changing to [[plugins/openid]], which does not
require ikiwiki deal with passwords at all, and does not involve users sending require ikiwiki deal with passwords at all, and does not involve users sending
passwords in cleartext over the net to log in, either. passwords in cleartext over the net to log in, either.
## Empty password security hole
This hole allowed ikiwiki to accept logins using empty passwords, to openid
accounts that didn't use a password. It was introduced in version 1.34, and
fixed in version 2.48. The [bug](http://bugs.debian.org/483770) was
discovered on 30 May 2008 and fixed the same day.
I recommend upgrading to 2.48 immediatly if your wiki allows both password
and openid logins.