aboutsummaryrefslogtreecommitdiff
path: root/doc
diff options
context:
space:
mode:
authorJoey Hess <joeyh@joeyh.name>2015-03-30 11:31:59 -0400
committerJoey Hess <joeyh@joeyh.name>2015-03-30 11:31:59 -0400
commit02f745a6755e063e921385bbbdcee02469f57269 (patch)
treed4af03c96fbaad43c125f4d74c51b77c866f72ff /doc
parent3b27d8fafaf382cee9c8ce6be426c601588e5503 (diff)
downloadikiwiki-02f745a6755e063e921385bbbdcee02469f57269.tar
ikiwiki-02f745a6755e063e921385bbbdcee02469f57269.tar.gz
update for recent XSS
Diffstat (limited to 'doc')
-rw-r--r--doc/security.mdwn9
1 files changed, 9 insertions, 0 deletions
diff --git a/doc/security.mdwn b/doc/security.mdwn
index afefd1bc3..6488d7f9e 100644
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -497,3 +497,12 @@ Raúl Benencia discovered an additional XSS exposure in the meta plugin.
This hole was discovered on 16 May 2012 and fixed the same day with
the release of ikiwiki 3.20120516. A fix was backported to Debian squeeze,
as version 3.20100815.9. An upgrade is recommended for all sites.
+
+## XSS via openid selector
+
+Raghav Bisht discovered this XSS in the openid selector.
+
+The hole was reported on March 24th, a fix was developed on March 27th,
+and the fixed version was released on the 29th. A fix was backported
+to Debian wheezy as version 3.20141016.2. An upgrade is recommended for
+sites using CGI and openid.