diff options
| author | Joey Hess <joey@kitenet.net> | 2011-01-22 10:23:09 -0400 |
|---|---|---|
| committer | Joey Hess <joey@kitenet.net> | 2011-01-22 10:23:09 -0400 |
| commit | afeb8db569b7e9bf52d418417e7af4153c10cb9a (patch) | |
| tree | ab97bded36db1f25f87a2b2ac3a3dce4d67c8113 /doc/security.mdwn | |
| parent | b5d7469830e3569adc0664b645f1321ba54b3655 (diff) | |
| download | ikiwiki-afeb8db569b7e9bf52d418417e7af4153c10cb9a.tar ikiwiki-afeb8db569b7e9bf52d418417e7af4153c10cb9a.tar.gz | |
document XSS
Diffstat (limited to 'doc/security.mdwn')
| -rw-r--r-- | doc/security.mdwn | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/doc/security.mdwn b/doc/security.mdwn index 4fa531eb1..e636a0e45 100644 --- a/doc/security.mdwn +++ b/doc/security.mdwn @@ -453,3 +453,12 @@ preview or moderation of comments with such a configuration. These problems were discovered on 12 November 2010 and fixed the same hour with the release of ikiwiki 3.20101112. ([[!cve CVE-2010-1673]]) + +## javascript insertation via insufficient checking in comments + +Dave B noticed that attempting to comment on an illegal page name could be +used for an XSS attack. + +This hole was discovered on 22 Jan 2011 and fixed the same day with +the release of ikiwiki 3.20110122. An upgrade is recommended for sites +with the comments plugin enabled. |