aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
...
* | New plugin: redirectLouis2017-02-18
|/
* Added a commentvegardv@75ae889e836bda8ce69bc038d8335c398a2f6f402017-02-10
|
* Added a commentsvetlana@192500fb6a2e2ef8e78d1a08cca64b1bca9833b92017-02-09
|
* Added a commentsmcv2017-02-09
|
* (no commit message)svetlana@192500fb6a2e2ef8e78d1a08cca64b1bca9833b92017-02-09
|
* +update broken urissvetlana2017-02-07
|
* (no commit message)svetlana2017-02-07
|
* Confuses a mapsvetlana2017-02-07
|
* (no commit message)svetlana2017-02-06
|
* removedsvetlana2017-02-05
|
* (no commit message)svetlana@192500fb6a2e2ef8e78d1a08cca64b1bca9833b92017-02-05
|
* change `pwd` to $HOME so assumptions are met even if you cd elsewheresmcv2017-02-03
|
* No longer using ikiwikime@4eb1b66f86170ba2ff0690b93ad01f46bfc8eac42017-02-03
|
* (no commit message)smcv2017-01-26
|
* Does not show up in the setupsvetlana2017-01-24
|
* * [[guppy|http://guppy.branchable.com]] an internationalized modular Python ↵svetlana2017-01-18
| | | | IRC bot
* Added a commentsmcv2017-01-18
|
* Added a comment: Do that through your web server, not ikiwikismcv2017-01-18
|
* (no commit message)openmedi2017-01-17
|
* Note another Debian 8 backportSimon McVittie2017-01-12
|
* Fix typoSimon McVittie2017-01-11
|
* Release 3.20170111Simon McVittie2017-01-11
|
* Document the security fix soon to be released in 3.20170111Simon McVittie2017-01-11
|
* remove: make it clearer that repeated page parameter is OK hereSimon McVittie2017-01-11
| | | | | | ikiwiki's web interface does not currently have UI for removing multiple pages simultaneously, but the remove plugin is robust against doing so. Use a clearer idiom to make that obvious.
* CGI, attachment, passwordauth: harden against repeated parametersSimon McVittie2017-01-11
| | | | | | | | | | These instances of code similar to OVE-20170111-0001 are not believed to be exploitable, because defined(), length(), setpassword(), userinfo_set() and the binary "." operator all have prototypes that force the relevant argument to be evaluated in scalar context. However, using a safer idiom makes mistakes less likely. (cherry picked from commit 69230a2220f673c66b5ab875bfc759b32a241c0d)
* passwordauth: avoid userinfo forgery via repeated email parameterSimon McVittie2017-01-11
| | | | | | OVE-20170111-0001 (cherry picked from commit bffb71d6a7d28f6dd5f0be241f214e79eea7bb91)
* t/passwordauth.t: new automated test for passwordauthSimon McVittie2017-01-11
| | | | | | In particular this includes an exploit for OVE-20170111-0001. (cherry picked from commit fbe207212b1f4a395dc297fb274ef07afd7d68f3)
* passwordauth: prevent authentication bypass via multiple name parametersSimon McVittie2017-01-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Calling CGI::FormBuilder::field with a name argument in list context returns zero or more user-specified values of the named field, even if that field was not declared as supporting multiple values. Passing the result of field as a function parameter counts as list context. This is the same bad behaviour that is now discouraged for CGI::param. In this case we pass the multiple values to CGI::Session::param. That accessor has six possible calling conventions, of which four are documented. If an attacker passes (2*n + 1) values for the 'name' field, for example name=a&name=b&name=c, we end up in one of the undocumented calling conventions for param: # equivalent to: (name => 'a', b => 'c') $session->param('name', 'a', 'b', 'c') and the 'b' session parameter is unexpectedly set to an attacker-specified value. In particular, if an attacker "bob" specifies name=bob&name=name&name=alice, then authentication is carried out for "bob" but the CGI::Session ends up containing {name => 'alice'}, an authentication bypass vulnerability. This vulnerability is tracked as OVE-20170111-0001. (cherry picked from commit e909eb93f4530a175d622360a8433e833ecf0254)
* 3.20170110Simon McVittie2017-01-10
|
* Sset libmagickcore-6.q16-3-extra as preferred build-dependencySimon McVittie2017-01-10
| | | | | The virtual package libmagickcore-extra is now merely an alternative, to help autopkgtest to do the right thing.
* d/ikiwiki.doc-base: register the documentation with doc-baseSimon McVittie2017-01-10
|
* d/ikiwiki.lintian-overrides: silence false positive spelling warning for ↵Simon McVittie2017-01-10
| | | | Moin Moin
* d/ikiwiki.lintian-overrides: override script-not-executable warningsSimon McVittie2017-01-10
|
* docwiki.setup: exclude TourBusStop from offline documentationSimon McVittie2017-01-10
| | | | It does not make much sense there.
* lintian: Override obsolete-url-in-packaging for OpenID SelectorSimon McVittie2017-01-10
| | | | | It does not seem to have any more current URL, and in any case our version is a fork.
* d/copyright: re-order to put more specific stanzas later, to get the ↵Simon McVittie2017-01-10
| | | | intended interpretation
* Set package format to 3.0 (native)Simon McVittie2017-01-10
|
* Update changelogSimon McVittie2017-01-09
|
* check_canchange: report invalid filenames as intendedSimon McVittie2017-01-09
| | | | | | Instead of logging "bad file name %s" and attempting to call the (string) filename as a subroutine, actually do the intended sprintf operation.
* news: Use Debian security tracker instead of MITRE for CVE referencesSimon McVittie2017-01-09
| | | | | | The Debian security tracker gets timely updates, whereas the official CVE pages hosted by MITRE tend to show up as "RESERVED" for several weeks or months after assignment.
* shortcuts: Use security-tracker.debian.org for [[!debcve]]Simon McVittie2017-01-09
| | | | security.debian.org currently rejects HTTPS connections.
* git: don't redundantly pass "--" to git_sha1Simon McVittie2017-01-09
| | | | | | | | | | | | | | | git_sha1 already puts "--" before its arguments, so git_sha1_file($dir, 'doc/index.mdwn') would have incorrectly invoked git rev-list --max-count=1 HEAD -- -- doc/index.mdwn If there is no file in the wiki named "--", that's harmless, because it merely names the latest revision in which either "--" or "doc/index.mdwn" changed. However, it could return incorrect results if there is somehow a file named "--".
* git: use parameters, not global state, to swap working directorySimon McVittie2017-01-09
|
* Revert "git: Turn $git_dir into a stack"Simon McVittie2017-01-09
| | | | | | | Now that we have avoided using in_git_dir recursively, we don't need the stack any more. This reverts commit 39b8931ad31fe6b48afdc570caa459a0996c2092.
* git-cgi.t: when committing directly, make sure we have a valid authorSimon McVittie2017-01-09
| | | | | In the environment used on ci.debian.net, we have neither a name nor an email address.
* git: do not mix in_git_dir with eval{}Simon McVittie2017-01-09
| | | | | | | | If we throw an exception (usually from run_or_die), in_git_dir won't unshift the current directory from the stack. That's usually fine, but in rcs_preprevert we catch exceptions and do some cleanup before returning, for which we need the git directory to be the root and not the temporary working tree.
* Use rel=nofollow microformat for comment authorsSimon McVittie2017-01-09
|
* Use rel=nofollow microformat for dynamic (CGI-related) URLsSimon McVittie2017-01-09
| | | | | | | Some of these might be relatively expensive to dereference or result in messages being logged, and there's no reason why a search engine should need to index them. (In particular, we'd probably prefer search engines to index the rendered page, not its source code.)
* t/git-cgi.t: fix race conditionSimon McVittie2017-01-09
| | | | | We need the changes to take place at least 1 second after the first rebuild, so that the changed files are seen to have changed.
* Enquote $background_command as surely intended.Amitai Schleier2017-01-02
|
generated by cgit v1.2.3 (git 2.25.4) at 2024-11-01 06:37:05 +0000