diff options
| -rw-r--r-- | IkiWiki/Plugin/meta.pm | 6 | ||||
| -rw-r--r-- | debian/changelog | 7 | ||||
| -rw-r--r-- | doc/security.mdwn | 9 |
3 files changed, 18 insertions, 4 deletions
diff --git a/IkiWiki/Plugin/meta.pm b/IkiWiki/Plugin/meta.pm index b19ea2b32..c79c8ccc0 100644 --- a/IkiWiki/Plugin/meta.pm +++ b/IkiWiki/Plugin/meta.pm @@ -318,8 +318,8 @@ sub pagetemplate (@) { $template->param(title_overridden => 1); } - foreach my $field (qw{author authorurl}) { - $template->param($field => $pagestate{$page}{meta}{$field}) + foreach my $field (qw{authorurl}) { + $template->param($field => HTML::Entities::encode_entities($pagestate{$page}{meta}{$field})) if exists $pagestate{$page}{meta}{$field} && $template->query(name => $field); } @@ -330,7 +330,7 @@ sub pagetemplate (@) { } } - foreach my $field (qw{description}) { + foreach my $field (qw{description author}) { eval q{use HTML::Entities}; $template->param($field => HTML::Entities::encode_numeric($pagestate{$page}{meta}{$field})) if exists $pagestate{$page}{meta}{$field} && $template->query(name => $field); diff --git a/debian/changelog b/debian/changelog index cefbb99ed..c7e4b1d11 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,10 @@ +ikiwiki (3.20120516) unstable; urgency=high + + * meta: Security fix; add missing sanitization of author and authorurl. + Thanks, Raúl Benencia + + -- Joey Hess <joeyh@debian.org> Wed, 16 May 2012 19:51:27 -0400 + ikiwiki (3.20120419) unstable; urgency=low * Remove dead link from plugins/teximg. Closes: #664885 diff --git a/doc/security.mdwn b/doc/security.mdwn index b573b5f23..99f40d3f1 100644 --- a/doc/security.mdwn +++ b/doc/security.mdwn @@ -482,9 +482,16 @@ Ludwig Nussel discovered a way for users to hijack root's tty when ikiwiki-mass-rebuild was run. Additionally, there was some potential for information disclosure via symlinks. ([[!cve CVE-2011-1408]]) -This hole was disconvered on 8 June 2011 and fixed the same day with +This hole was discovered on 8 June 2011 and fixed the same day with the release of ikiwiki 3.20110608. Note that the fix is dependant on a version of su that has a similar hole fixed; [[!debbug 628843]] tracks fixing the hole in Debian's su. An upgrade is a must for any sites that have `ikiwiki-update-wikilist` installed suid (not the default), and whose admins run `ikiwiki-mass-rebuild`. + +## javascript insertion via meta tags + +Raúl Benencia discovered an additional XSS exposure in the meta plugin. + +This hole was discovered on 16 May 2012 and fixed the same day with +the release of ikiwiki 3.20120516. |