* Avoid potential syslog format string issue, although only older versions

  of perl are vulnerable and it is not known to really be exploitable from
  ikiwiki.

diff --git a/IkiWiki.pm b/IkiWiki.pm
index 5f0dca38568f745e561a6fe80ba7c75a6c555ccb..2392c787bedc49e7c34d8c654b6e8d1ef0fb7064 100644 (file)
--- a/IkiWiki.pm
+++ b/IkiWiki.pm
@@ -174,7 +174,7 @@ sub log_message ($$) { #{{{
                        $log_open=1;
                }
                eval {
-                       Sys::Syslog::syslog($type, join(" ", @_));
+                       Sys::Syslog::syslog($type, "%s", join(" ", @_));
                }
        }
        elsif (! $config{cgi}) {

diff --git a/debian/changelog b/debian/changelog
index 2c7ded1fab5a2065c0df8d5843f1148ef38167de..ee88086ffaaab700e229082d69954f3470e47613 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -26,8 +26,11 @@ ikiwiki (1.43) UNRELEASED; urgency=low
   * Add a prettydate plugin that formats dates in a more readable fashion.
     (I had to get a pretty date somehow today..)
   * Updated Czech translation.
+  * Avoid potential syslog format string issue, although only older versions
+    of perl are vulnerable and it is not known to really be exploitable from
+    ikiwiki.
 
- -- Joey Hess <joeyh@debian.org>  Sat, 17 Feb 2007 14:02:32 -0500
+ -- Joey Hess <joeyh@debian.org>  Sat, 17 Feb 2007 16:32:35 -0500
 
 ikiwiki (1.42) unstable; urgency=low