meta: Security fix; add missing sanitization of author and authorurl. Thanks, Raúl...

diff --git a/IkiWiki/Plugin/meta.pm b/IkiWiki/Plugin/meta.pm
index b19ea2b3294b0e1c985c56162084b5e2430d6398..c79c8ccc08169842c8c292157015332af5ed855a 100644 (file)
--- a/IkiWiki/Plugin/meta.pm
+++ b/IkiWiki/Plugin/meta.pm
@@ -318,8 +318,8 @@ sub pagetemplate (@) {
                $template->param(title_overridden => 1);
        }
 
-       foreach my $field (qw{author authorurl}) {
-               $template->param($field => $pagestate{$page}{meta}{$field})
+       foreach my $field (qw{authorurl}) {
+               $template->param($field => HTML::Entities::encode_entities($pagestate{$page}{meta}{$field}))
                        if exists $pagestate{$page}{meta}{$field} && $template->query(name => $field);
        }
 
@@ -330,7 +330,7 @@ sub pagetemplate (@) {
                }
        }
 
-       foreach my $field (qw{description}) {
+       foreach my $field (qw{description author}) {
                eval q{use HTML::Entities};
                $template->param($field => HTML::Entities::encode_numeric($pagestate{$page}{meta}{$field}))
                        if exists $pagestate{$page}{meta}{$field} && $template->query(name => $field);

diff --git a/debian/changelog b/debian/changelog
index cefbb99edb0e08bc49fe4de00c13feee95f57f67..c7e4b1d112f58e95fda1c9d215513ae5556160e0 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+ikiwiki (3.20120516) unstable; urgency=high
+
+  * meta: Security fix; add missing sanitization of author and authorurl.
+    Thanks, Raúl Benencia
+
+ -- Joey Hess <joeyh@debian.org>  Wed, 16 May 2012 19:51:27 -0400
+
 ikiwiki (3.20120419) unstable; urgency=low
 
   * Remove dead link from plugins/teximg. Closes: #664885

diff --git a/doc/security.mdwn b/doc/security.mdwn
index b573b5f2348a3bea028706f1af7d5433b3b0f9a7..99f40d3f1bf40b11b37753353cbabc1e12e5e943 100644 (file)
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -482,9 +482,16 @@ Ludwig Nussel discovered a way for users to hijack root's tty when
 ikiwiki-mass-rebuild was run. Additionally, there was some potential
 for information disclosure via symlinks. ([[!cve CVE-2011-1408]])
 
-This hole was disconvered on 8 June 2011 and fixed the same day with
+This hole was discovered on 8 June 2011 and fixed the same day with
 the release of ikiwiki 3.20110608. Note that the fix is dependant on
 a version of su that has a similar hole fixed; [[!debbug 628843]]
 tracks fixing the hole in Debian's su. An upgrade is a must for any
 sites that have `ikiwiki-update-wikilist` installed suid (not the default),
 and whose admins run `ikiwiki-mass-rebuild`.
+
+## javascript insertion via meta tags
+
+Raúl Benencia discovered an additional XSS exposure in the meta plugin.
+
+This hole was discovered on 16 May 2012 and fixed the same day with
+the release of ikiwiki 3.20120516.