X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/c49af80ab38f71abcbe9887dde4b76d462595f4a..bad740b94387d4289d6267715e09c2bedf1f210b:/doc/security.mdwn?ds=inline

diff --git a/doc/security.mdwn b/doc/security.mdwn
index 723c01863..b1e8d03f6 100644
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -18,7 +18,7 @@ _(The list of things to fix.)_
 
 Anyone with direct commit access can forge "web commit from foo" and
 make it appear on [[RecentChanges]] like foo committed. One way to avoid
-this would be to limit web commits to those done by a certian user.
+this would be to limit web commits to those done by a certain user.
 
 ## other stuff to look at
 
@@ -80,7 +80,7 @@ they can try to use this to exploit your web server.
 
 _(AKA, the assumptions that will be the root of most security holes...)_
 
-## exploting ikiwiki with bad content
+## exploiting ikiwiki with bad content
 
 Someone could add bad content to the wiki and hope to exploit ikiwiki.
 Note that ikiwiki runs with perl taint checks on, so this is unlikely.
@@ -279,3 +279,39 @@ Various directives that cause one page to be included into another could
 be exploited to DOS the wiki, by causing a loop. Ikiwiki has always guarded
 against this one way or another; the current solution should detect all
 types of loops involving preprocessor directives.
+
+## Online editing of existing css and images
+
+A bug in ikiwiki allowed the web-based editor to edit any file that was in
+the wiki, not just files that are page sources. So an attacker (or a
+genuinely helpful user, which is how the hole came to light) could edit
+files like style.css. It is also theoretically possible that an attacker
+could have used this hole to edit images or other files in the wiki, with
+some difficulty, since all editing would happen in a textarea.
+
+This hole was discovered on 10 Feb 2007 and fixed the same day with the
+release of ikiwiki 1.42. A fix was also backported to Debian etch, as
+version 1.33.1. I recommend upgrading to one of these versions if your wiki
+allows web editing.
+
+## html insertion via title
+
+Missing html escaping of the title contents allowed a web-based editor to
+insert arbitrary html inside the title tag of a page. Since that part of
+the page is not processed by the htmlscrubber, evil html could be injected.
+
+This hole was discovered on 21 March 2007 and fixed the same day (er, hour) 
+with the release of ikiwiki 1.46. A fix was also backported to Debian etch,
+as version 1.33.2. I recommend upgrading to one of these versions if your
+wiki allows web editing or aggregates feeds.
+
+## javascript insertion via meta tags
+
+It was possible to use the meta plugin's meta tags to insert arbitrary
+url contents, which could be used to insert stylesheet information
+containing javascript. This was fixed by sanitising meta tags.
+
+This hole was discovered on 21 March 2007 and fixed the same day
+with the release of ikiwiki 1.47. A fix was also backported to Debian etch,
+as version 1.33.3. I recommend upgrading to one of these versions if your
+wiki can be edited by third parties.