| Commit message (Expand) | Author | Age |
|---|
| ... | |
| * | 3.20170110 | Simon McVittie | 2017-01-10 |
| * | Sset libmagickcore-6.q16-3-extra as preferred build-dependency•••The virtual package libmagickcore-extra is now merely an alternative,
to help autopkgtest to do the right thing.
| Simon McVittie | 2017-01-10 |
| * | d/ikiwiki.doc-base: register the documentation with doc-base | Simon McVittie | 2017-01-10 |
| * | d/ikiwiki.lintian-overrides: silence false positive spelling warning for Moin... | Simon McVittie | 2017-01-10 |
| * | d/ikiwiki.lintian-overrides: override script-not-executable warnings | Simon McVittie | 2017-01-10 |
| * | docwiki.setup: exclude TourBusStop from offline documentation•••It does not make much sense there.
| Simon McVittie | 2017-01-10 |
| * | lintian: Override obsolete-url-in-packaging for OpenID Selector•••It does not seem to have any more current URL, and in any case our
version is a fork.
| Simon McVittie | 2017-01-10 |
| * | d/copyright: re-order to put more specific stanzas later, to get the intended... | Simon McVittie | 2017-01-10 |
| * | Set package format to 3.0 (native) | Simon McVittie | 2017-01-10 |
| * | Update changelog | Simon McVittie | 2017-01-09 |
| * | check_canchange: report invalid filenames as intended•••Instead of logging "bad file name %s" and attempting to call the
(string) filename as a subroutine, actually do the intended
sprintf operation.
| Simon McVittie | 2017-01-09 |
| * | news: Use Debian security tracker instead of MITRE for CVE references•••The Debian security tracker gets timely updates, whereas the official
CVE pages hosted by MITRE tend to show up as "RESERVED" for several
weeks or months after assignment.
| Simon McVittie | 2017-01-09 |
| * | shortcuts: Use security-tracker.debian.org for [[!debcve]]•••security.debian.org currently rejects HTTPS connections.
| Simon McVittie | 2017-01-09 |
| * | git: don't redundantly pass "--" to git_sha1•••git_sha1 already puts "--" before its arguments, so
git_sha1_file($dir, 'doc/index.mdwn')
would have incorrectly invoked
git rev-list --max-count=1 HEAD -- -- doc/index.mdwn
If there is no file in the wiki named "--", that's harmless, because
it merely names the latest revision in which either "--" or
"doc/index.mdwn" changed. However, it could return incorrect results
if there is somehow a file named "--".
| Simon McVittie | 2017-01-09 |
| * | git: use parameters, not global state, to swap working directory | Simon McVittie | 2017-01-09 |
| * | Revert "git: Turn $git_dir into a stack"•••Now that we have avoided using in_git_dir recursively, we don't need
the stack any more.
This reverts commit 39b8931ad31fe6b48afdc570caa459a0996c2092.
| Simon McVittie | 2017-01-09 |
| * | git-cgi.t: when committing directly, make sure we have a valid author•••In the environment used on ci.debian.net, we have neither a name nor
an email address.
| Simon McVittie | 2017-01-09 |
| * | git: do not mix in_git_dir with eval{}•••If we throw an exception (usually from run_or_die), in_git_dir won't
unshift the current directory from the stack. That's usually fine,
but in rcs_preprevert we catch exceptions and do some cleanup before
returning, for which we need the git directory to be the root and
not the temporary working tree.
| Simon McVittie | 2017-01-09 |
| * | Use rel=nofollow microformat for comment authors | Simon McVittie | 2017-01-09 |
| * | Use rel=nofollow microformat for dynamic (CGI-related) URLs•••Some of these might be relatively expensive to dereference or result
in messages being logged, and there's no reason why a search engine
should need to index them. (In particular, we'd probably prefer search
engines to index the rendered page, not its source code.)
| Simon McVittie | 2017-01-09 |
| * | t/git-cgi.t: fix race condition•••We need the changes to take place at least 1 second after the first
rebuild, so that the changed files are seen to have changed.
| Simon McVittie | 2017-01-09 |
| * | Enquote $background_command as surely intended. | Amitai Schleier | 2017-01-02 |
| * | add debian security tracker | https://anarc.at/openid/ | 2016-12-30 |
| * | Merge remote-tracking branch 'origin/master' | Simon McVittie | 2016-12-29 |
| |\ |
|
| | * | add anchors for use in advisory to oss-security | smcv | 2016-12-29 |
| * | | 3.20161229.1 | Simon McVittie | 2016-12-29 |
| * | | git: Do not disable commit hook for temporary working tree•••We exclude .git/hooks from symlinking into the temporary working tree,
which avoids the commit hook being run for the temporary branch anyway.
This avoids the wiki not being updated if an orthogonal change is
received in process A, while process B prepares a revert that is
subsequently cancelled.
| Simon McVittie | 2016-12-29 |
| * | | git: Attribute reverts to the user doing the revert, not the wiki itself | Simon McVittie | 2016-12-29 |
| |/ |
|
| * | Clarify which versions of ikiwiki fixed CVE-2016-9645, -9646 | Simon McVittie | 2016-12-29 |
| * | 3.20161229 | Simon McVittie | 2016-12-29 |
| * | Add CVE references for CVE-2016-9646, CVE-2016-9645•••Thanks to the Debian security team for allocating these.
| Simon McVittie | 2016-12-29 |
| * | Prune git remotes that are unreachable or unresponsive | Simon McVittie | 2016-12-29 |
| * | git: Add test coverage for reverting attachments | Simon McVittie | 2016-12-28 |
| * | git: write proposed attachment to temp file without going via system() | Simon McVittie | 2016-12-28 |
| * | git: change calling convention of safe_git to have named arguments | Simon McVittie | 2016-12-28 |
| * | git: Do the revert operation in a secondary working tree•••This avoids leaving the git directory in an inconsistent state if the
host system is rebooted while we are processing a revert.
| Simon McVittie | 2016-12-28 |
| * | git: Turn $git_dir into a stack•••This will be necessary when we use a secondary working tree to do
reverts without leaving the primary working tree in an inconsistent
state.
| Simon McVittie | 2016-12-28 |
| * | Add automated test for using the CGI with git, including CVE-2016-10026 | Simon McVittie | 2016-12-28 |
| * | Try revert operations (on a branch) before approving them•••Otherwise, we have a time-of-check/time-of-use vulnerability:
rcs_preprevert previously looked at what changed in the commit we are
reverting, not at what would result from reverting it now. In
particular, if some files were renamed since the commit we are
reverting, a revert of changes that were within the designated
subdirectory and allowed by check_canchange() might now affect
files that are outside the designated subdirectory or disallowed
by check_canchange().
It is not sufficient to disable rename detection, since git older
than 2.8.0rc0 (in particular the version in Debian stable) silently
accepts and ignores the relevant options.
OVE-20161226-0002
| Simon McVittie | 2016-12-28 |
| * | Revert "Tell `git revert` not to follow renames"•••This doesn't work prior to git 2.8: `git revert` silently ignores the
option and succeeds. We will have to fix CVE-2016-10026 some other way.
This reverts commit 9cada49ed6ad24556dbe9861ad5b0a9f526167f9.
| Simon McVittie | 2016-12-28 |
| * | Force CGI::FormBuilder->field to scalar context where necessary•••CGI::FormBuilder->field has behaviour similar to the CGI.pm misfeature
we avoided in f4ec7b0. Force it into scalar context where it is used
in an argument list.
This prevents two (relatively minor) commit metadata forgery
vulnerabilities:
* In the comments plugin, an attacker who was able to post a comment
could give it a user-specified author and author-URL even if the wiki
configuration did not allow for that, by crafting multiple values
to other fields.
* In the editpage plugin, an attacker who was able to edit a page
could potentially forge commit authorship by crafting multiple values
for the rcsinfo field.
The remaining plugins changed in this commit appear to have been
protected by use of explicit scalar prototypes for the called functions,
but have been changed anyway to make them more obviously correct.
In particular, checkpassword() in passwordauth has a known prototype,
so an attacker cannot trick it into treating multiple values of the
name field as being the username, password and field to check for.
OVE-20161226-0001
| Simon McVittie | 2016-12-28 |
| * | git: do not fail to commit if committer is anonymous | Simon McVittie | 2016-12-28 |
| * | git: don't issue a warning if rcsinfo is undefined•••The intention here seems to be that $prev may be undefined, and the
only way that can legitimately happen is for $params{token} to be
undefined too.
| Simon McVittie | 2016-12-28 |
| * | git_revert test: reinstate ikiwiki.setup, and make it work uninstalled•••Previously it was relying on running with an installed ikiwiki
and being able to copy in recentchanges.mdwn and wikiicons/ from the
underlay in /usr. The underlay in ./underlays/basewiki can't be used
(yet) because ikiwiki doesn't allow following symlinks, even from
underlays.
I'd like to make ikiwiki follow symlinks whose destinations can be
verified to be safe (for example making it willing to expose
/usr/share/javascript to the web, but not /etc/passwd), at least from
underlays, but this is security-sensitive so I'm not going to rush
into it.
| Simon McVittie | 2016-12-28 |
| * | Added a comment | spalax | 2016-12-26 |
| * | Added a comment | smcv | 2016-12-26 |
| * | Question about default timezone ":/etc/localtime" | spalax | 2016-12-25 |
| * | Add CVE references for CVE-2016-10026 | Simon McVittie | 2016-12-21 |
| * | Replied. | intrigeri | 2016-12-20 |
| * | Announce 3.20161219 | Simon McVittie | 2016-12-19 |