* Patch from James Westby to add a --sslcookie switch, which forces

  cookies to only be sent over ssl connections to avoid interception.
* Factor out the cgi header printing code into a new function.
* Fix preferences page on anonok wikis; still need to sign in to get
  to the preferences page.

diff --git a/IkiWiki.pm b/IkiWiki.pm
index b6e160ab6e0010ab1007c98d80e7ebb0c6b19a1a..990836f8e461226442933064d2d62defb457e27d 100644 (file)
--- a/IkiWiki.pm
+++ b/IkiWiki.pm
@@ -54,6 +54,7 @@ sub defaultconfig () { #{{{
        plugin => [qw{mdwn inline htmlscrubber}],
        timeformat => '%c',
        locale => undef,
+       sslcookie => 0,
 } #}}}
    
 sub checkconfig () { #{{{

diff --git a/IkiWiki/CGI.pm b/IkiWiki/CGI.pm
index 120e2fdee7dad588a027f6ef0264d995714e4a5b..8e0339dc5436097e1727390076903fe3933171a5 100644 (file)
--- a/IkiWiki/CGI.pm
+++ b/IkiWiki/CGI.pm
@@ -9,6 +9,18 @@ use Encode;
 
 package IkiWiki;
 
+sub printheader ($) { #{{{
+       my $session=shift;
+       
+       if ($config{sslcookie}) {
+               print $session->header(-charset => 'utf-8',
+                       -cookie => $session->cookie(-secure => 1));
+       } else {
+               print $session->header(-charset => 'utf-8');
+       }
+
+} #}}}
+
 sub redirect ($$) { #{{{
        my $q=shift;
        my $url=shift;
@@ -72,7 +84,7 @@ sub cgi_recentchanges ($) { #{{{
                changelog => [rcs_recentchanges(100)],
                baseurl => baseurl(),
        );
-       print $q->header(-charset=>'utf-8'), $template->output;
+       print $q->header(-charset => 'utf-8'), $template->output;
 } #}}}
 
 sub cgi_signin ($$) { #{{{
@@ -204,7 +216,7 @@ sub cgi_signin ($$) { #{{{
                                $form->field(name => "confirm_password", type => "hidden");
                                $form->field(name => "email", type => "hidden");
                                $form->text("Registration successful. Now you can Login.");
-                               print $session->header(-charset=>'utf-8');
+                               printheader($session);
                                print misctemplate($form->title, $form->render(submit => ["Login"]));
                        }
                        else {
@@ -232,12 +244,12 @@ sub cgi_signin ($$) { #{{{
                        
                        $form->text("Your password has been emailed to you.");
                        $form->field(name => "name", required => 0);
-                       print $session->header(-charset=>'utf-8');
+                       printheader($session);
                        print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
                }
        }
        else {
-               print $session->header(-charset=>'utf-8');
+               printheader($session);
                print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
        }
 } #}}}
@@ -314,7 +326,7 @@ sub cgi_prefs ($$) { #{{{
                $form->text("Preferences saved.");
        }
        
-       print $session->header(-charset=>'utf-8');
+       printheader($session);
        print misctemplate($form->title, $form->render(submit => \@buttons));
 } #}}}
 
@@ -596,7 +608,7 @@ sub cgi () { #{{{
        umask($oldmask);
        
        # Everything below this point needs the user to be signed in.
-       if ((! $config{anonok} &&
+       if (((! $config{anonok} || $do eq 'prefs') &&
             (! defined $session->param("name") ||
             ! userinfo_get($session->param("name"), "regdate"))) || $do eq 'signin') {
                cgi_signin($q, $session);

diff --git a/debian/changelog b/debian/changelog
index 7636cd12e39b73f465a521099486b646c70d8f90..2d1fd37778d538aedb48f768c5f0564224b442ab 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -35,8 +35,13 @@ ikiwiki (1.22) UNRELEASED; urgency=low
   * Patch from James Westby to add a template for the search form.
   * Cache search form for speedup.
   * Added a ddate plugin.
+  * Patch from James Westby to add a --sslcookie switch, which forces
+    cookies to only be sent over ssl connections to avoid interception.
+  * Factor out the cgi header printing code into a new function.
+  * Fix preferences page on anonok wikis; still need to sign in to get
+    to the preferences page.
 
- -- Joey Hess <joeyh@debian.org>  Sat, 26 Aug 2006 23:48:31 -0400
+ -- Joey Hess <joeyh@debian.org>  Sun, 27 Aug 2006 16:17:21 -0400
 
 ikiwiki (1.21) unstable; urgency=low
 

diff --git a/doc/ikiwiki.setup b/doc/ikiwiki.setup
index bf1aa3703a41d8d48f1a66a98e849929947d5664..9a4b61ec407a3e2d8b05b639f8503c36e4ce813d 100644 (file)
--- a/doc/ikiwiki.setup
+++ b/doc/ikiwiki.setup
@@ -74,6 +74,8 @@ use IkiWiki::Setup::Standard {
        #timeformat => '%c',
        # Locale to use. Must be a UTF-8 locale.
        #locale => 'en_US.UTF-8',
+       # Only send cookies over SSL connections.
+       #sslcookie => 1,
        # Logging settings:
        verbose => 0,
        syslog => 0,

diff --git a/doc/patchqueue/use-ssl-for-cookies.mdwn b/doc/patchqueue/use-ssl-for-cookies.mdwn
deleted file mode 100644 (file)
index c2ee637..0000000
--- a/doc/patchqueue/use-ssl-for-cookies.mdwn
+++ /dev/null
@@ -1,20 +0,0 @@
-It is very easy to stop the password being sniffed, you just use https:// for cgiurl
-(with appropriately configure server of course), and disallow access to the cgiscript
-over http.
-
-However the cookie is still sent for all requests, meaning that it could be stolen.
-I don't know quite how well CGI::Session defends against this, but the best it could
-do is probably tie it to an IP address, but that still leaves room for abuse.
-
-I have created a patch that adds a config option sslcookie, which causes the
-cookie to have it's secure property set. This means that it is only sent over SSL.
-So if you can configure apache to do what you want, you only have to change two options
-(cgiurl and sslcookie) to encrypt all authentication data.
-
-The disadvantage is that if someone were to activate it while using http:// I think it
-would mean they couldn't log in, as the browser would never offer the cookie. 
-I think I have made the documentation clear enough on this point.
-
-http://jameswestby.net/scratch/sslcookie.diff
-
--- JamesWestby
\ No newline at end of file

diff --git a/doc/security.mdwn b/doc/security.mdwn
index dc763ef40a01bbae7d0f7ec09a3b8d08130dee89..9d7702dde3a09053fb09c27a9553a8829f4068e6 100644 (file)
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -134,7 +134,9 @@ file not be world readable.
 
 Login to the wiki involves sending a password in cleartext over the net.
 Cracking the password only allows editing the wiki as that user though.
-If you care, you can use https, I suppose.
+If you care, you can use https, I suppose. If you do use https either for
+all of the wiki, or just the cgi access, then consider using the sslcookie
+option.
 
 ## XSS holes in CGI output
 

diff --git a/doc/usage.mdwn b/doc/usage.mdwn
index efbc765ac0933dc8fd04fcc22b857a0bb942c085..4456e8c1ce66119bd981169f366b76ba2bbc6829 100644 (file)
--- a/doc/usage.mdwn
+++ b/doc/usage.mdwn
@@ -227,6 +227,12 @@ configuration options of their own.
   Enable [[w3mmode]], which allows w3m to use ikiwiki as a local CGI script,
   without a web server.
 
+* --sslcookie
+
+  Only send cookies over an SSL connection. This should prevent them being
+  intercepted. If you enable this option then you must run at least the 
+  CGI portion of ikiwiki over SSL.
+
 * --getctime
 
   Pull last changed time for each new page out of the revision control

diff --git a/ikiwiki.pl b/ikiwiki.pl
index c9b53a03181f3787aa13106ea2f9bf7033834206..aa0fd136a14c46ff9a2a961c16f8fc0840d37302 100755 (executable)
--- a/ikiwiki.pl
+++ b/ikiwiki.pl
@@ -45,6 +45,7 @@ sub getconfig () { #{{{
                        "svnpath" => \$config{svnpath},
                        "adminemail=s" => \$config{adminemail},
                        "timeformat=s" => \$config{timeformat},
+                       "sslcookie!" => \$config{sslcookie},
                        "exclude=s@" => sub {
                                $config{wiki_file_prune_regexp}=qr/$config{wiki_file_prune_regexp}|$_[1]/;
                        },