From 2bb435bdcdc65bc51699ca3f8993bca99546f026 Mon Sep 17 00:00:00 2001 From: Joey Hess Date: Mon, 24 Jan 2011 16:56:28 -0400 Subject: [PATCH] bleagh (cherry picked from commit 2be49b623a85b10ad584d7e4e8c31c8436d1c16f) --- IkiWiki/Plugin/comments.pm | 2 +- debian/changelog | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/IkiWiki/Plugin/comments.pm b/IkiWiki/Plugin/comments.pm index 6bacd26c7..29c9d4f40 100644 --- a/IkiWiki/Plugin/comments.pm +++ b/IkiWiki/Plugin/comments.pm @@ -365,7 +365,7 @@ sub editcomment ($$) { # The untaint is OK (as in editpage) because we're about to pass # it to file_pruned and wiki_file_regexp anyway. - my $page = $form->field('page')=~/$config{wiki_file_regexp}/; + my ($page) = $form->field('page')=~/$config{wiki_file_regexp}/; $page = IkiWiki::possibly_foolish_untaint($page); if (! defined $page || ! length $page || IkiWiki::file_pruned($page)) { diff --git a/debian/changelog b/debian/changelog index 4f9b06d29..604f1b1da 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +ikiwiki (3.20110124) UNRELEASED; urgency=low + + * comments: Fix commenting, broken by security fix. + + -- Joey Hess Mon, 24 Jan 2011 16:56:05 -0400 + ikiwiki (3.20100815.5) testing; urgency=low * comments: Fix XSS security hole due to missing validation of page name. -- 2.39.2