| Commit message (Collapse) | Author | Age | |
|---|---|---|---|
| * | add debian security tracker | https://anarc.at/openid/ | 2016-12-30 |
| | | |||
| * | Merge remote-tracking branch 'origin/master' | Simon McVittie | 2016-12-29 |
| |\ | |||
| | * | add anchors for use in advisory to oss-security | smcv | 2016-12-29 |
| | | | |||
| * | | 3.20161229.1 | Simon McVittie | 2016-12-29 |
| |/ | |||
| * | Clarify which versions of ikiwiki fixed CVE-2016-9645, -9646 | Simon McVittie | 2016-12-29 |
| | | |||
| * | 3.20161229 | Simon McVittie | 2016-12-29 |
| | | |||
| * | Add CVE references for CVE-2016-9646, CVE-2016-9645 | Simon McVittie | 2016-12-29 |
| | | | | | Thanks to the Debian security team for allocating these. | ||
| * | Prune git remotes that are unreachable or unresponsive | Simon McVittie | 2016-12-29 |
| | | |||
| * | Try revert operations (on a branch) before approving them | Simon McVittie | 2016-12-28 |
| | | | | | | | | | | | | | | | | | | Otherwise, we have a time-of-check/time-of-use vulnerability: rcs_preprevert previously looked at what changed in the commit we are reverting, not at what would result from reverting it now. In particular, if some files were renamed since the commit we are reverting, a revert of changes that were within the designated subdirectory and allowed by check_canchange() might now affect files that are outside the designated subdirectory or disallowed by check_canchange(). It is not sufficient to disable rename detection, since git older than 2.8.0rc0 (in particular the version in Debian stable) silently accepts and ignores the relevant options. OVE-20161226-0002 | ||
| * | Force CGI::FormBuilder->field to scalar context where necessary | Simon McVittie | 2016-12-28 |
| | | | | | | | | | | | | | | | | | | | | | | | | | | | CGI::FormBuilder->field has behaviour similar to the CGI.pm misfeature we avoided in f4ec7b0. Force it into scalar context where it is used in an argument list. This prevents two (relatively minor) commit metadata forgery vulnerabilities: * In the comments plugin, an attacker who was able to post a comment could give it a user-specified author and author-URL even if the wiki configuration did not allow for that, by crafting multiple values to other fields. * In the editpage plugin, an attacker who was able to edit a page could potentially forge commit authorship by crafting multiple values for the rcsinfo field. The remaining plugins changed in this commit appear to have been protected by use of explicit scalar prototypes for the called functions, but have been changed anyway to make them more obviously correct. In particular, checkpassword() in passwordauth has a known prototype, so an attacker cannot trick it into treating multiple values of the name field as being the username, password and field to check for. OVE-20161226-0001 | ||
| * | Added a comment | spalax | 2016-12-26 |
| | | |||
| * | Added a comment | smcv | 2016-12-26 |
| | | |||
| * | Question about default timezone ":/etc/localtime" | spalax | 2016-12-25 |
| | | |||
| * | Add CVE references for CVE-2016-10026 | Simon McVittie | 2016-12-21 |
| | | |||
| * | Replied. | intrigeri | 2016-12-20 |
| | | |||
| * | Announce 3.20161219 | Simon McVittie | 2016-12-19 |
| | | |||
| * | mention security contacts here too | smcv | 2016-12-19 |
| | | |||
| * | Opt in to whatever spam this may bring. | Amitai Schleier | 2016-12-19 |
| | | |||
| * | Restrict CSS matches on .header to not affect <tr> | Simon McVittie | 2016-12-19 |
| | | | | | | | | Pandoc generates <tr class="header"> to hold <th> elements, and we don't want to make those be display: block. Signed-off-by: Simon McVittie <smcv@debian.org> | ||
| * | List security contacts | Simon McVittie | 2016-12-19 |
| | | | | | | We still don't have a security@ alias; listing personal emails is unfortunately the next-best thing. | ||
| * | Tell `git revert` not to follow renames | Simon McVittie | 2016-12-19 |
| | | | | | | | | | | | | | Otherwise, we have an authorization bypass vulnerability: rcs_preprevert looks at what changed in the commit we are reverting, not at what would result from reverting it now. In particular, if some files were renamed since the commit we are reverting, a revert of changes that were within the designated subdirectory and allowed by check_canchange() might now affect files that are outside the designated subdirectory or disallowed by check_canchange(). Signed-off-by: Simon McVittie <smcv@debian.org> | ||
| * | Added a comment: no, not supported | smcv | 2016-12-19 |
| | | |||
| * | rename bugs/img_tag_should_support_relative_size.mdwn to ↵ | smcv | 2016-12-19 |
| | | | | | todo/img_tag_should_support_relative_size.mdwn | ||
| * | Not possible as stated, but could be adapted into a valid feature request | smcv | 2016-12-19 |
| | | |||
| * | (no commit message) | smcv | 2016-12-19 |
| | | |||
| * | cgitemplate: remove dead code | Simon McVittie | 2016-12-19 |
| | | | | | | | | | blipvert points out in [[bugs/use of $topurl in cgitemplate]] that this variable has not been used since commit a052771 "Now that we're always using HTML5, <base href> can be relative". Signed-off-by: Simon McVittie <smcv@debian.org> | ||
| * | Report authorization bypass via RCS revert. | intrigeri | 2016-12-17 |
| | | |||
| * | (no commit message) | blipvert@b874dc05477cdc0dc8c9c8d9bbe2e39240253a85 | 2016-12-14 |
| | | |||
| * | (no commit message) | blipvert@b874dc05477cdc0dc8c9c8d9bbe2e39240253a85 | 2016-12-14 |
| | | |||
| * | (no commit message) | blipvert@b874dc05477cdc0dc8c9c8d9bbe2e39240253a85 | 2016-12-14 |
| | | |||
| * | (no commit message) | jeff+ikiwiki@b5854f0ab9935492e3dfefa98419b6530c92b049 | 2016-11-26 |
| | | |||
| * | pagestats determinism: report bug + patch. | intrigeri | 2016-11-20 |
| | | |||
| * | svetlana.nfshost | svetlana@192500fb6a2e2ef8e78d1a08cca64b1bca9833b9 | 2016-11-17 |
| | | |||
| * | Added custom solution | Juego | 2016-11-16 |
| | | |||
| * | rename forum/FastCGI_problem_on_Arch.mdwn to ↵ | Juego | 2016-11-16 |
| | | | | | forum/__91__Solved__93__FastCGI_problem_on_Arch.mdwn | ||
| * | Update my personal site URL. | Amitai Schleier | 2016-11-12 |
| | | |||
| * | update my site links. | james@2468840dc8f314e837e1fde99a5fb1b884fa993a | 2016-11-12 |
| | | |||
| * | Added a comment | openmedi | 2016-11-10 |
| | | |||
| * | Added a comment | openmedi | 2016-11-10 |
| | | |||
| * | (no commit message) | openmedi | 2016-11-10 |
| | | |||
| * | Added a comment | openmedi | 2016-11-06 |
| | | |||
| * | Added a comment | openmedi | 2016-11-03 |
| | | |||
| * | (no commit message) | vegardv@75ae889e836bda8ce69bc038d8335c398a2f6f40 | 2016-11-03 |
| | | |||
| * | (no commit message) | vegardv@75ae889e836bda8ce69bc038d8335c398a2f6f40 | 2016-11-03 |
| | | |||
| * | consider portier as a successor to OpenID? | https://id.koumbit.net/anarcat | 2016-11-01 |
| | | |||
| * | introduce portier here as well, while i'm here | https://id.koumbit.net/anarcat | 2016-11-01 |
| | | |||
| * | nextgen persona? | https://id.koumbit.net/anarcat | 2016-11-01 |
| | | |||
| * | another look at bootstrap and packaging strategies | https://id.koumbit.net/anarcat | 2016-11-01 |
| | | |||
| * | The C2 wiki appears to have moved. | Amitai Schleier | 2016-10-23 |
| | | |||
| * | (no commit message) | openmedi | 2016-10-16 |
| | | |||