From: Joey Hess <joey@kitenet.net>
Date: Sat, 22 Jan 2011 14:23:29 +0000 (-0400)
Subject: Merge branch 'master' of ssh://git.ikiwiki.info/srv/git/ikiwiki.info
X-Git-Tag: 3.20110122~1
X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/commitdiff_plain/872dc3de27e86ee2491c48a9156983a58e598f63?hp=4e6426236bc32f5571265febcc860fb31fa10481

Merge branch 'master' of ssh://git.ikiwiki.info/srv/git/ikiwiki.info
---

diff --git a/IkiWiki/Plugin/comments.pm b/IkiWiki/Plugin/comments.pm
index 1287590a7..d9183970d 100644
--- a/IkiWiki/Plugin/comments.pm
+++ b/IkiWiki/Plugin/comments.pm
@@ -364,8 +364,8 @@ sub editcomment ($$) {
 	}
 
 	# The untaint is OK (as in editpage) because we're about to pass
-	# it to file_pruned anyway
-	my $page = $form->field('page');
+	# it to file_pruned and wiki_file_regexp anyway.
+	my $page = $form->field('page')=~/$config{wiki_file_regexp}/;
 	$page = IkiWiki::possibly_foolish_untaint($page);
 	if (! defined $page || ! length $page ||
 		IkiWiki::file_pruned($page)) {
diff --git a/IkiWiki/Plugin/editpage.pm b/IkiWiki/Plugin/editpage.pm
index df29bcc98..8c78e853c 100644
--- a/IkiWiki/Plugin/editpage.pm
+++ b/IkiWiki/Plugin/editpage.pm
@@ -91,12 +91,12 @@ sub cgi_editpage ($$) {
 	# This untaint is safe because we check file_pruned and
 	# wiki_file_regexp.
 	my ($page)=$form->field('page')=~/$config{wiki_file_regexp}/;
-	$page=possibly_foolish_untaint($page);
-	my $absolute=($page =~ s#^/+##); # absolute name used to force location
 	if (! defined $page || ! length $page ||
 	    file_pruned($page)) {
 		error(gettext("bad page name"));
 	}
+	$page=possibly_foolish_untaint($page);
+	my $absolute=($page =~ s#^/+##); # absolute name used to force location
 
 	my $baseurl = urlto($page);
 
diff --git a/IkiWiki/Plugin/rename.pm b/IkiWiki/Plugin/rename.pm
index 57747d3c9..e871b815d 100644
--- a/IkiWiki/Plugin/rename.pm
+++ b/IkiWiki/Plugin/rename.pm
@@ -567,6 +567,7 @@ sub fixlinks ($$$) {
 		}
 		if ($needfix) {
 			my $file=$pagesources{$page};
+			next unless -e $config{srcdir}."/".$file;
 			my $oldcontent=readfile($config{srcdir}."/".$file);
 			my $content=renamepage_hook($page, $rename->{src}, $rename->{dest}, $oldcontent);
 			if ($oldcontent ne $content) {
diff --git a/debian/changelog b/debian/changelog
index 36e4a9576..bed0bd6b4 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -4,6 +4,10 @@ ikiwiki (3.20110106) UNRELEASED; urgency=low
     to feed links. (Giuseppe Bilotta)
   * inline: Use class rather than id for feedlinks and blogform.
     (Giuseppe Bilotta)
+  * comments: Fix XSS security hole due to missing validation of page name.
+    (Thanks, Dave B.)
+  * rename: Fix crash when renaming a page that is linked to by a page
+    in an underlay.
 
  -- Joey Hess <joeyh@debian.org>  Thu, 06 Jan 2011 14:41:34 -0400
 
diff --git a/doc/security.mdwn b/doc/security.mdwn
index 4fa531eb1..e636a0e45 100644
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -453,3 +453,12 @@ preview or moderation of comments with such a configuration.
 
 These problems were discovered on 12 November 2010 and fixed the same
 hour with the release of ikiwiki 3.20101112. ([[!cve CVE-2010-1673]])
+
+## javascript insertation via insufficient checking in comments
+
+Dave B noticed that attempting to comment on an illegal page name could be
+used for an XSS attack.
+
+This hole was discovered on 22 Jan 2011 and fixed the same day with
+the release of ikiwiki 3.20110122. An upgrade is recommended for sites
+with the comments plugin enabled.