From afeb8db569b7e9bf52d418417e7af4153c10cb9a Mon Sep 17 00:00:00 2001 From: Joey Hess Date: Sat, 22 Jan 2011 10:23:09 -0400 Subject: document XSS --- doc/security.mdwn | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'doc/security.mdwn') diff --git a/doc/security.mdwn b/doc/security.mdwn index 4fa531eb1..e636a0e45 100644 --- a/doc/security.mdwn +++ b/doc/security.mdwn @@ -453,3 +453,12 @@ preview or moderation of comments with such a configuration. These problems were discovered on 12 November 2010 and fixed the same hour with the release of ikiwiki 3.20101112. ([[!cve CVE-2010-1673]]) + +## javascript insertation via insufficient checking in comments + +Dave B noticed that attempting to comment on an illegal page name could be +used for an XSS attack. + +This hole was discovered on 22 Jan 2011 and fixed the same day with +the release of ikiwiki 3.20110122. An upgrade is recommended for sites +with the comments plugin enabled. -- cgit v1.2.3