others edit pages in your wiki, then some possible security issues do need
to be kept in mind.
+[[toc levels=2]]
+
----
# Probable holes
Anyone with direct commit access can forge "web commit from foo" and
make it appear on [[RecentChanges]] like foo committed. One way to avoid
-this would be to limit web commits to those done by a certian user.
+this would be to limit web commits to those done by a certain user.
## other stuff to look at
----
+# Plugins
+
+The security of [[plugins]] depends on how well they're written and what
+external tools they use. The plugins included in ikiwiki are all held to
+the same standards as the rest of ikiwiki, but with that said, here are
+some security notes for them.
+
+* The [[plugins/img]] plugin assumes that imagemagick/perlmagick are secure
+ from malformed image attacks. Imagemagick has had security holes in the
+ past. To be able to exploit such a hole, a user would need to be able to
+ upload images to the wiki.
+
+----
+
# Fixed holes
_(Unless otherwise noted, these were discovered and immediately fixed by the
point. #[378412](http://bugs.debian.org/378412) could affect us, although it
doesn't seem very exploitable. It has a simple fix, and has been fixed in
Debian unstable.
+
+## include loops
+
+Various directives that cause one page to be included into another could
+be exploited to DOS the wiki, by causing a loop. Ikiwiki has always guarded
+against this one way or another; the current solution should detect all
+types of loops involving preprocessor directives.