Fix CSRF attacks against the preferences and edit forms. Closes: #475445

[git.ikiwiki.info.git] / doc / security.mdwn

diff --git a/doc/security.mdwn b/doc/security.mdwn
index 9259209eeb34e99714d247dfee1144e929c90533..29ae7d4b3bc30c81e7c70d5b82e8660318c44952 100644 (file)
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -149,7 +149,7 @@ option.
 
 ## XSS holes in CGI output
 
 
 ## XSS holes in CGI output
 

-ikiwiki has not yet been audited to ensure that all cgi script input/output
+ikiwiki has been audited to ensure that all cgi script input/output

 is sanitised to prevent XSS attacks. For example, a user can't register
 with a username containing html code (anymore).
 
 is sanitised to prevent XSS attacks. For example, a user can't register
 with a username containing html code (anymore).
 


@@ -356,12 +356,24 @@ allow the security hole to be exploited.
 ## javascript insertion via uris
 
 The htmlscrubber did not block javascript in uris. This was fixed by adding
 ## javascript insertion via uris
 
 The htmlscrubber did not block javascript in uris. This was fixed by adding

-a whitelist of valid uri types, which does not include javascript. Some
-urls specifyable by the meta plugin could also theoretically have been used
-to inject javascript; this was also blocked.
+a whitelist of valid uri types, which does not include javascript. 
+([[cve CVE-2008-0809]]) Some urls specifyable by the meta plugin could also
+theoretically have been used to inject javascript; this was also blocked
+([[cve CVE-2008-0808]]).

 
 This hole was discovered on 10 February 2008 and fixed the same day
 with the release of ikiwiki 2.31.1. (And a few subsequent versions..)
 A fix was also backported to Debian etch, as version 1.33.4. I recommend
 upgrading to one of these versions if your wiki can be edited by third
 parties.
 
 This hole was discovered on 10 February 2008 and fixed the same day
 with the release of ikiwiki 2.31.1. (And a few subsequent versions..)
 A fix was also backported to Debian etch, as version 1.33.4. I recommend
 upgrading to one of these versions if your wiki can be edited by third
 parties.

+
+## Cross Site Request Forging
+
+Cross Site Request Forging could be used to constuct a link that would
+change a logged-in user's password or other preferences if they clicked on
+the link. It could also be used to construct a link that would cause a wiki
+page to be modified by a logged-in user.
+
+These holes were discovered on 10 April 2008 and fixed the same day with
+the release of ikiwiki 2.42. A fix was also backported to Debian etch, as
+version 1.33.4. I recommend upgrading to one of these versions.