From fbfcea89f8e06426c73ab8ea369ca4cdc566db6f Mon Sep 17 00:00:00 2001
From: Joey Hess <joey@kitenet.net>
Date: Wed, 16 May 2012 19:54:41 -0400
Subject: [PATCH] =?UTF-8?q?meta:=20Security=20fix;=20add=20missing=20sanit?=
 =?UTF-8?q?ization=20of=20author=20and=20authorurl.=20Thanks,=20Ra=C3=BAl?=
 =?UTF-8?q?=20Benencia?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 IkiWiki/Plugin/meta.pm | 6 +++---
 debian/changelog       | 7 +++++++
 doc/security.mdwn      | 9 ++++++++-
 3 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/IkiWiki/Plugin/meta.pm b/IkiWiki/Plugin/meta.pm
index b19ea2b32..c79c8ccc0 100644
--- a/IkiWiki/Plugin/meta.pm
+++ b/IkiWiki/Plugin/meta.pm
@@ -318,8 +318,8 @@ sub pagetemplate (@) {
 		$template->param(title_overridden => 1);
 	}
 
-	foreach my $field (qw{author authorurl}) {
-		$template->param($field => $pagestate{$page}{meta}{$field})
+	foreach my $field (qw{authorurl}) {
+		$template->param($field => HTML::Entities::encode_entities($pagestate{$page}{meta}{$field}))
 			if exists $pagestate{$page}{meta}{$field} && $template->query(name => $field);
 	}
 
@@ -330,7 +330,7 @@ sub pagetemplate (@) {
 		}
 	}
 
-	foreach my $field (qw{description}) {
+	foreach my $field (qw{description author}) {
 		eval q{use HTML::Entities};
 		$template->param($field => HTML::Entities::encode_numeric($pagestate{$page}{meta}{$field}))
 			if exists $pagestate{$page}{meta}{$field} && $template->query(name => $field);
diff --git a/debian/changelog b/debian/changelog
index cefbb99ed..c7e4b1d11 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+ikiwiki (3.20120516) unstable; urgency=high
+
+  * meta: Security fix; add missing sanitization of author and authorurl.
+    Thanks, Raúl Benencia
+
+ -- Joey Hess <joeyh@debian.org>  Wed, 16 May 2012 19:51:27 -0400
+
 ikiwiki (3.20120419) unstable; urgency=low
 
   * Remove dead link from plugins/teximg. Closes: #664885
diff --git a/doc/security.mdwn b/doc/security.mdwn
index b573b5f23..99f40d3f1 100644
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -482,9 +482,16 @@ Ludwig Nussel discovered a way for users to hijack root's tty when
 ikiwiki-mass-rebuild was run. Additionally, there was some potential
 for information disclosure via symlinks. ([[!cve CVE-2011-1408]])
 
-This hole was disconvered on 8 June 2011 and fixed the same day with
+This hole was discovered on 8 June 2011 and fixed the same day with
 the release of ikiwiki 3.20110608. Note that the fix is dependant on
 a version of su that has a similar hole fixed; [[!debbug 628843]]
 tracks fixing the hole in Debian's su. An upgrade is a must for any
 sites that have `ikiwiki-update-wikilist` installed suid (not the default),
 and whose admins run `ikiwiki-mass-rebuild`.
+
+## javascript insertion via meta tags
+
+Raúl Benencia discovered an additional XSS exposure in the meta plugin.
+
+This hole was discovered on 16 May 2012 and fixed the same day with
+the release of ikiwiki 3.20120516.