urosm
/
ikiwiki
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

meta: Security fix; add missing sanitization of author and authorurl. Thanks, Raúl Benencia

master
Joey Hess 2012-05-16 19:54:41 -04:00
parent 95a8b8868f
commit fbfcea89f8
3 changed files with 18 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
IkiWiki/Plugin/meta.pm
View File

@ -318,8 +318,8 @@ sub pagetemplate (@) {
$template->param(title_overridden => 1);
}
foreach my $field (qw{author authorurl}) {
$template->param($field => $pagestate{$page}{meta}{$field})
foreach my $field (qw{authorurl}) {
$template->param($field => HTML::Entities::encode_entities($pagestate{$page}{meta}{$field}))
if exists $pagestate{$page}{meta}{$field} && $template->query(name => $field);
}
@ -330,7 +330,7 @@ sub pagetemplate (@) {
}
}
foreach my $field (qw{description}) {
foreach my $field (qw{description author}) {
eval q{use HTML::Entities};
$template->param($field => HTML::Entities::encode_numeric($pagestate{$page}{meta}{$field}))
if exists $pagestate{$page}{meta}{$field} && $template->query(name => $field);

7
debian/changelog vendored
View File

@ -1,3 +1,10 @@
ikiwiki (3.20120516) unstable; urgency=high
* meta: Security fix; add missing sanitization of author and authorurl.
Thanks, Raúl Benencia
-- Joey Hess <joeyh@debian.org> Wed, 16 May 2012 19:51:27 -0400
ikiwiki (3.20120419) unstable; urgency=low
* Remove dead link from plugins/teximg. Closes: #664885

9
doc/security.mdwn
View File

@ -482,9 +482,16 @@ Ludwig Nussel discovered a way for users to hijack root's tty when
ikiwiki-mass-rebuild was run. Additionally, there was some potential
for information disclosure via symlinks. ([[!cve CVE-2011-1408]])
This hole was disconvered on 8 June 2011 and fixed the same day with
This hole was discovered on 8 June 2011 and fixed the same day with
the release of ikiwiki 3.20110608. Note that the fix is dependant on
a version of su that has a similar hole fixed; [[!debbug 628843]]
tracks fixing the hole in Debian's su. An upgrade is a must for any
sites that have `ikiwiki-update-wikilist` installed suid (not the default),
and whose admins run `ikiwiki-mass-rebuild`.
## javascript insertion via meta tags
Raúl Benencia discovered an additional XSS exposure in the meta plugin.
This hole was discovered on 16 May 2012 and fixed the same day with
the release of ikiwiki 3.20120516.