From f38ad993b4b5f293ec691e0d3182e761791ee273 Mon Sep 17 00:00:00 2001
From: Joey Hess <joey@kodama.kitenet.net>
Date: Sun, 10 Feb 2008 13:55:34 -0500
Subject: [PATCH] fix backport

---
 IkiWiki/Plugin/htmlscrubber.pm |  5 +++--
 debian/changelog               |  4 ++--
 t/htmlize.t                    | 12 ++++++++----
 3 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/IkiWiki/Plugin/htmlscrubber.pm b/IkiWiki/Plugin/htmlscrubber.pm
index c4a0d60af..60ad17baf 100644
--- a/IkiWiki/Plugin/htmlscrubber.pm
+++ b/IkiWiki/Plugin/htmlscrubber.pm
@@ -53,7 +53,7 @@ sub scrubber { #{{{
 			span strike strong sub sup table tbody td textarea
 			tfoot th thead tr tt u ul var
 		}],
-		default => [undef, { map { $_ => 1 } qw{
+		default => [undef, { ( map { $_ => 1 } qw{
 			abbr accept accept-charset accesskey
 			align alt axis border cellpadding cellspacing
 			char charoff charset checked cite class
@@ -66,7 +66,8 @@ sub scrubber { #{{{
 			selected shape size span start summary
 			tabindex target title type usemap valign
 			value vspace width
-		}, "/" => 1, # emit proper <hr /> XHTML
+		} ),
+		"/" => 1, # emit proper <hr /> XHTML
 		href => $link,
 		src => $link,
 		action => $link,
diff --git a/debian/changelog b/debian/changelog
index 4776e1461..7dd7a2a29 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,6 +1,6 @@
-ikiwiki (1.33.4) testing-proposed-updates; urgency=medium
+ikiwiki (1.33.4) stable-security; urgency=high
 
-  * htmlscrubber security fix: Block javascript in uris.
+  * htmlscrubber security fix: Block javascript in uris. Closes: #465110
   * Add htmlscrubber test suite.
 
  -- Joey Hess <joeyh@debian.org>  Sun, 10 Feb 2008 13:34:28 -0500
diff --git a/t/htmlize.t b/t/htmlize.t
index edf357010..0be94ab6b 100755
--- a/t/htmlize.t
+++ b/t/htmlize.t
@@ -58,13 +58,17 @@ ok(gotcha(q{<img src="javascript.png?GOTCHA">}), "not javascript");
 ok(gotcha(q{<a href="javascript.png?GOTCHA">foo</a>}), "not javascript");
 is(IkiWiki::htmlize("foo", "mdwn",
 	q{<img alt="foo" src="foo.gif">}),
-	q{<img alt="foo" src="foo.gif">}, "img with alt tag allowed");
+	q{<p><img alt="foo" src="foo.gif"></p>
+}, "img with alt tag allowed");
 is(IkiWiki::htmlize("foo", "mdwn",
 	q{<a href="http://google.com/">}),
-	q{<a href="http://google.com/">}, "absolute url allowed");
+	q{<p><a href="http://google.com/"></p>
+}, "absolute url allowed");
 is(IkiWiki::htmlize("foo", "mdwn",
 	q{<a href="foo.html">}),
-	q{<a href="foo.html">}, "relative url allowed");
+	q{<p><a href="foo.html"></p>
+}, "relative url allowed");
 is(IkiWiki::htmlize("foo", "mdwn",
 	q{<span class="foo">bar</span>}),
-	q{<span class="foo">bar</span>}, "class attribute allowed");
+	q{<p><span class="foo">bar</span></p>
+}, "class attribute allowed");
-- 
2.39.2