(no commit message)

[git.ikiwiki.info.git] / doc / security.mdwn

diff --git a/doc/security.mdwn b/doc/security.mdwn
index 2b387ac2322c1accdd57b9edca7c6b0f6c36c1b8..35385465607929108d488eff73fa395e71d82467 100644 (file)
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -22,8 +22,8 @@ this would be to limit web commits to those done by a certain user.
 
 ## other stuff to look at
 
 
 ## other stuff to look at
 

-I need to audit the git backend a bit, and have been meaning to
-see if any CRLF injection type things can be done in the CGI code.
+I have been meaning to see if any CRLF injection type things can be
+done in the CGI code.

 
 ----
 
 
 ----
 


@@ -466,11 +466,11 @@ with the comments plugin enabled. ([[!cve CVE-2011-0428]])
 
 ## possible javascript insertion via insufficient htmlscrubbing of alternate stylesheets
 
 
 ## possible javascript insertion via insufficient htmlscrubbing of alternate stylesheets
 

-Tango noticed that 'meta stylesheet` directives allowed anyone
+Giuseppe Bilotta noticed that 'meta stylesheet` directives allowed anyone

 who could upload a malicious stylesheet to a site to add it to a
 who could upload a malicious stylesheet to a site to add it to a

-page as an alternate stylesheet. In order to be exploited, the user
-would have to select the alternative stylesheet in their browser.
+page as an alternate stylesheet, or replacing the default stylesheet.

 
 This hole was discovered on 28 Mar 2011 and fixed the same hour with
 the release of ikiwiki 3.20110328. An upgrade is recommended for sites
 that have untrusted committers, or have the attachments plugin enabled.
 
 This hole was discovered on 28 Mar 2011 and fixed the same hour with
 the release of ikiwiki 3.20110328. An upgrade is recommended for sites
 that have untrusted committers, or have the attachments plugin enabled.

+([[!cve CVE-2011-1401]])