web commit by http://bremner.myopenid.com/: link to work in progress

[git.ikiwiki.info.git] / doc / security.mdwn

diff --git a/doc/security.mdwn b/doc/security.mdwn
index ea8954f5c234bf771483372c9763c9adb75160f8..57cac719f41c7bd0bba1f46e472f8a0e486327d8 100644 (file)
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -390,7 +390,7 @@ pre-emtively guard against that, current versions of ikiwiki store password
 hashes (using Eksblowfish).
 
 If you use the [[plugins/passwordauth]] plugin, I recommend upgrading to
 hashes (using Eksblowfish).
 
 If you use the [[plugins/passwordauth]] plugin, I recommend upgrading to

-ikiwiki 2.48, installing the [[Authen::Passphrase]] perl module, and running
+ikiwiki 2.48, installing the [[cpan Authen::Passphrase]] perl module, and running

 `ikiwiki-transition hashpassword` to replace all existing cleartext passwords
 with strong blowfish hashes. 
 
 `ikiwiki-transition hashpassword` to replace all existing cleartext passwords
 with strong blowfish hashes. 
 


@@ -403,7 +403,7 @@ passwords in cleartext over the net to log in, either.
 This hole allowed ikiwiki to accept logins using empty passwords, to openid
 accounts that didn't use a password. It was introduced in version 1.34, and
 fixed in version 2.48. The [bug](http://bugs.debian.org/483770) was
 This hole allowed ikiwiki to accept logins using empty passwords, to openid
 accounts that didn't use a password. It was introduced in version 1.34, and
 fixed in version 2.48. The [bug](http://bugs.debian.org/483770) was

-discovered on 30 May 2008 and fixed the same day.
+discovered on 30 May 2008 and fixed the same day. ([[cve CVE-2008-0169]])

 
 I recommend upgrading to 2.48 immediatly if your wiki allows both password
 and openid logins.
 
 I recommend upgrading to 2.48 immediatly if your wiki allows both password
 and openid logins.