aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* Release 3.20170111Simon McVittie2017-01-11
|
* Document the security fix soon to be released in 3.20170111Simon McVittie2017-01-11
|
* remove: make it clearer that repeated page parameter is OK hereSimon McVittie2017-01-11
| | | | | | ikiwiki's web interface does not currently have UI for removing multiple pages simultaneously, but the remove plugin is robust against doing so. Use a clearer idiom to make that obvious.
* CGI, attachment, passwordauth: harden against repeated parametersSimon McVittie2017-01-11
| | | | | | | | | | These instances of code similar to OVE-20170111-0001 are not believed to be exploitable, because defined(), length(), setpassword(), userinfo_set() and the binary "." operator all have prototypes that force the relevant argument to be evaluated in scalar context. However, using a safer idiom makes mistakes less likely. (cherry picked from commit 69230a2220f673c66b5ab875bfc759b32a241c0d)
* passwordauth: avoid userinfo forgery via repeated email parameterSimon McVittie2017-01-11
| | | | | | OVE-20170111-0001 (cherry picked from commit bffb71d6a7d28f6dd5f0be241f214e79eea7bb91)
* t/passwordauth.t: new automated test for passwordauthSimon McVittie2017-01-11
| | | | | | In particular this includes an exploit for OVE-20170111-0001. (cherry picked from commit fbe207212b1f4a395dc297fb274ef07afd7d68f3)
* passwordauth: prevent authentication bypass via multiple name parametersSimon McVittie2017-01-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Calling CGI::FormBuilder::field with a name argument in list context returns zero or more user-specified values of the named field, even if that field was not declared as supporting multiple values. Passing the result of field as a function parameter counts as list context. This is the same bad behaviour that is now discouraged for CGI::param. In this case we pass the multiple values to CGI::Session::param. That accessor has six possible calling conventions, of which four are documented. If an attacker passes (2*n + 1) values for the 'name' field, for example name=a&name=b&name=c, we end up in one of the undocumented calling conventions for param: # equivalent to: (name => 'a', b => 'c') $session->param('name', 'a', 'b', 'c') and the 'b' session parameter is unexpectedly set to an attacker-specified value. In particular, if an attacker "bob" specifies name=bob&name=name&name=alice, then authentication is carried out for "bob" but the CGI::Session ends up containing {name => 'alice'}, an authentication bypass vulnerability. This vulnerability is tracked as OVE-20170111-0001. (cherry picked from commit e909eb93f4530a175d622360a8433e833ecf0254)
* 3.20170110Simon McVittie2017-01-10
|
* Sset libmagickcore-6.q16-3-extra as preferred build-dependencySimon McVittie2017-01-10
| | | | | The virtual package libmagickcore-extra is now merely an alternative, to help autopkgtest to do the right thing.
* d/ikiwiki.doc-base: register the documentation with doc-baseSimon McVittie2017-01-10
|
* d/ikiwiki.lintian-overrides: silence false positive spelling warning for ↵Simon McVittie2017-01-10
| | | | Moin Moin
* d/ikiwiki.lintian-overrides: override script-not-executable warningsSimon McVittie2017-01-10
|
* docwiki.setup: exclude TourBusStop from offline documentationSimon McVittie2017-01-10
| | | | It does not make much sense there.
* lintian: Override obsolete-url-in-packaging for OpenID SelectorSimon McVittie2017-01-10
| | | | | It does not seem to have any more current URL, and in any case our version is a fork.
* d/copyright: re-order to put more specific stanzas later, to get the ↵Simon McVittie2017-01-10
| | | | intended interpretation
* Set package format to 3.0 (native)Simon McVittie2017-01-10
|
* Update changelogSimon McVittie2017-01-09
|
* check_canchange: report invalid filenames as intendedSimon McVittie2017-01-09
| | | | | | Instead of logging "bad file name %s" and attempting to call the (string) filename as a subroutine, actually do the intended sprintf operation.
* news: Use Debian security tracker instead of MITRE for CVE referencesSimon McVittie2017-01-09
| | | | | | The Debian security tracker gets timely updates, whereas the official CVE pages hosted by MITRE tend to show up as "RESERVED" for several weeks or months after assignment.
* shortcuts: Use security-tracker.debian.org for [[!debcve]]Simon McVittie2017-01-09
| | | | security.debian.org currently rejects HTTPS connections.
* git: don't redundantly pass "--" to git_sha1Simon McVittie2017-01-09
| | | | | | | | | | | | | | | git_sha1 already puts "--" before its arguments, so git_sha1_file($dir, 'doc/index.mdwn') would have incorrectly invoked git rev-list --max-count=1 HEAD -- -- doc/index.mdwn If there is no file in the wiki named "--", that's harmless, because it merely names the latest revision in which either "--" or "doc/index.mdwn" changed. However, it could return incorrect results if there is somehow a file named "--".
* git: use parameters, not global state, to swap working directorySimon McVittie2017-01-09
|
* Revert "git: Turn $git_dir into a stack"Simon McVittie2017-01-09
| | | | | | | Now that we have avoided using in_git_dir recursively, we don't need the stack any more. This reverts commit 39b8931ad31fe6b48afdc570caa459a0996c2092.
* git-cgi.t: when committing directly, make sure we have a valid authorSimon McVittie2017-01-09
| | | | | In the environment used on ci.debian.net, we have neither a name nor an email address.
* git: do not mix in_git_dir with eval{}Simon McVittie2017-01-09
| | | | | | | | If we throw an exception (usually from run_or_die), in_git_dir won't unshift the current directory from the stack. That's usually fine, but in rcs_preprevert we catch exceptions and do some cleanup before returning, for which we need the git directory to be the root and not the temporary working tree.
* Use rel=nofollow microformat for comment authorsSimon McVittie2017-01-09
|
* Use rel=nofollow microformat for dynamic (CGI-related) URLsSimon McVittie2017-01-09
| | | | | | | Some of these might be relatively expensive to dereference or result in messages being logged, and there's no reason why a search engine should need to index them. (In particular, we'd probably prefer search engines to index the rendered page, not its source code.)
* t/git-cgi.t: fix race conditionSimon McVittie2017-01-09
| | | | | We need the changes to take place at least 1 second after the first rebuild, so that the changed files are seen to have changed.
* Enquote $background_command as surely intended.Amitai Schleier2017-01-02
|
* add debian security trackerhttps://anarc.at/openid/2016-12-30
|
* Merge remote-tracking branch 'origin/master'Simon McVittie2016-12-29
|\
| * add anchors for use in advisory to oss-securitysmcv2016-12-29
| |
* | 3.20161229.1Simon McVittie2016-12-29
| |
* | git: Do not disable commit hook for temporary working treeSimon McVittie2016-12-29
| | | | | | | | | | | | | | | | We exclude .git/hooks from symlinking into the temporary working tree, which avoids the commit hook being run for the temporary branch anyway. This avoids the wiki not being updated if an orthogonal change is received in process A, while process B prepares a revert that is subsequently cancelled.
* | git: Attribute reverts to the user doing the revert, not the wiki itselfSimon McVittie2016-12-29
|/
* Clarify which versions of ikiwiki fixed CVE-2016-9645, -9646Simon McVittie2016-12-29
|
* 3.20161229Simon McVittie2016-12-29
|
* Add CVE references for CVE-2016-9646, CVE-2016-9645Simon McVittie2016-12-29
| | | | Thanks to the Debian security team for allocating these.
* Prune git remotes that are unreachable or unresponsiveSimon McVittie2016-12-29
|
* git: Add test coverage for reverting attachmentsSimon McVittie2016-12-28
|
* git: write proposed attachment to temp file without going via system()Simon McVittie2016-12-28
|
* git: change calling convention of safe_git to have named argumentsSimon McVittie2016-12-28
|
* git: Do the revert operation in a secondary working treeSimon McVittie2016-12-28
| | | | | This avoids leaving the git directory in an inconsistent state if the host system is rebooted while we are processing a revert.
* git: Turn $git_dir into a stackSimon McVittie2016-12-28
| | | | | | This will be necessary when we use a secondary working tree to do reverts without leaving the primary working tree in an inconsistent state.
* Add automated test for using the CGI with git, including CVE-2016-10026Simon McVittie2016-12-28
|
* Try revert operations (on a branch) before approving themSimon McVittie2016-12-28
| | | | | | | | | | | | | | | | | Otherwise, we have a time-of-check/time-of-use vulnerability: rcs_preprevert previously looked at what changed in the commit we are reverting, not at what would result from reverting it now. In particular, if some files were renamed since the commit we are reverting, a revert of changes that were within the designated subdirectory and allowed by check_canchange() might now affect files that are outside the designated subdirectory or disallowed by check_canchange(). It is not sufficient to disable rename detection, since git older than 2.8.0rc0 (in particular the version in Debian stable) silently accepts and ignores the relevant options. OVE-20161226-0002
* Revert "Tell `git revert` not to follow renames"Simon McVittie2016-12-28
| | | | | | | This doesn't work prior to git 2.8: `git revert` silently ignores the option and succeeds. We will have to fix CVE-2016-10026 some other way. This reverts commit 9cada49ed6ad24556dbe9861ad5b0a9f526167f9.
* Force CGI::FormBuilder->field to scalar context where necessarySimon McVittie2016-12-28
| | | | | | | | | | | | | | | | | | | | | | | | | | CGI::FormBuilder->field has behaviour similar to the CGI.pm misfeature we avoided in f4ec7b0. Force it into scalar context where it is used in an argument list. This prevents two (relatively minor) commit metadata forgery vulnerabilities: * In the comments plugin, an attacker who was able to post a comment could give it a user-specified author and author-URL even if the wiki configuration did not allow for that, by crafting multiple values to other fields. * In the editpage plugin, an attacker who was able to edit a page could potentially forge commit authorship by crafting multiple values for the rcsinfo field. The remaining plugins changed in this commit appear to have been protected by use of explicit scalar prototypes for the called functions, but have been changed anyway to make them more obviously correct. In particular, checkpassword() in passwordauth has a known prototype, so an attacker cannot trick it into treating multiple values of the name field as being the username, password and field to check for. OVE-20161226-0001
* git: do not fail to commit if committer is anonymousSimon McVittie2016-12-28
|
* git: don't issue a warning if rcsinfo is undefinedSimon McVittie2016-12-28
| | | | | | The intention here seems to be that $prev may be undefined, and the only way that can legitimately happen is for $params{token} to be undefined too.
generated by cgit v1.2.3 (git 2.25.4) at 2024-09-26 04:49:58 +0000