From: Joey Hess <joey@kitenet.net>
Date: Mon, 28 Mar 2011 16:38:46 +0000 (-0400)
Subject: meta: Security fix; don't allow alternative stylesheets to be added on pages where... 
X-Git-Tag: 3.20100815.7~1
X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/commitdiff_plain/e096762c54594810957125520a5626abaabdee15

meta: Security fix; don't allow alternative stylesheets to be added on pages where the htmlscrubber is enabled.
---

diff --git a/IkiWiki/Plugin/meta.pm b/IkiWiki/Plugin/meta.pm
index eccbf976c..c33c8b238 100644
--- a/IkiWiki/Plugin/meta.pm
+++ b/IkiWiki/Plugin/meta.pm
@@ -173,10 +173,10 @@ sub preprocess (@) {
 		if (! length $stylesheet) {
 			error gettext("stylesheet not found")
 		}
-		push @{$metaheaders{$page}}, '<link href="'.urlto($stylesheet, $page).
+		push @{$metaheaders{$page}}, scrub('<link href="'.urlto($stylesheet, $page).
 			'" rel="'.encode_entities($rel).
 			'" title="'.encode_entities($title).
-			"\" type=\"text/css\" />";
+			"\" type=\"text/css\" />", $page, $destpage);
 	}
 	elsif ($key eq 'openid') {
 		my $delegate=0; # both by default
diff --git a/debian/changelog b/debian/changelog
index b4d502d00..900f6a984 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+ikiwiki (3.20100815.7) stable-security; urgency=high
+
+  * meta: Security fix; don't allow alternative stylesheets to be added on
+    pages where the htmlscrubber is enabled.
+
+ -- Joey Hess <joeyh@debian.org>  Mon, 28 Mar 2011 12:35:13 -0400
+
 ikiwiki (3.20100815.6) testing; urgency=low
 
   * comments: Fix commenting, broken by security fix.