From fbfcea89f8e06426c73ab8ea369ca4cdc566db6f Mon Sep 17 00:00:00 2001
From: Joey Hess <joey@kitenet.net>
Date: Wed, 16 May 2012 19:54:41 -0400
Subject: [PATCH] =?utf8?q?meta:=20Security=20fix;=20add=20missing=20saniti?=
=?utf8?q?zation=20of=20author=20and=20authorurl.=20Thanks,=20Ra=C3=BAl=20?=
=?utf8?q?Benencia?=
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit
---
IkiWiki/Plugin/meta.pm | 6 +++---
debian/changelog | 7 +++++++
doc/security.mdwn | 9 ++++++++-
3 files changed, 18 insertions(+), 4 deletions(-)
diff --git a/IkiWiki/Plugin/meta.pm b/IkiWiki/Plugin/meta.pm
index b19ea2b32..c79c8ccc0 100644
--- a/IkiWiki/Plugin/meta.pm
+++ b/IkiWiki/Plugin/meta.pm
@@ -318,8 +318,8 @@ sub pagetemplate (@) {
$template->param(title_overridden => 1);
}
- foreach my $field (qw{author authorurl}) {
- $template->param($field => $pagestate{$page}{meta}{$field})
+ foreach my $field (qw{authorurl}) {
+ $template->param($field => HTML::Entities::encode_entities($pagestate{$page}{meta}{$field}))
if exists $pagestate{$page}{meta}{$field} && $template->query(name => $field);
}
@@ -330,7 +330,7 @@ sub pagetemplate (@) {
}
}
- foreach my $field (qw{description}) {
+ foreach my $field (qw{description author}) {
eval q{use HTML::Entities};
$template->param($field => HTML::Entities::encode_numeric($pagestate{$page}{meta}{$field}))
if exists $pagestate{$page}{meta}{$field} && $template->query(name => $field);
diff --git a/debian/changelog b/debian/changelog
index cefbb99ed..c7e4b1d11 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+ikiwiki (3.20120516) unstable; urgency=high
+
+ * meta: Security fix; add missing sanitization of author and authorurl.
+ Thanks, Raúl Benencia
+
+ -- Joey Hess <joeyh@debian.org> Wed, 16 May 2012 19:51:27 -0400
+
ikiwiki (3.20120419) unstable; urgency=low
* Remove dead link from plugins/teximg. Closes: #664885
diff --git a/doc/security.mdwn b/doc/security.mdwn
index b573b5f23..99f40d3f1 100644
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -482,9 +482,16 @@ Ludwig Nussel discovered a way for users to hijack root's tty when
ikiwiki-mass-rebuild was run. Additionally, there was some potential
for information disclosure via symlinks. ([[!cve CVE-2011-1408]])
-This hole was disconvered on 8 June 2011 and fixed the same day with
+This hole was discovered on 8 June 2011 and fixed the same day with
the release of ikiwiki 3.20110608. Note that the fix is dependant on
a version of su that has a similar hole fixed; [[!debbug 628843]]
tracks fixing the hole in Debian's su. An upgrade is a must for any
sites that have `ikiwiki-update-wikilist` installed suid (not the default),
and whose admins run `ikiwiki-mass-rebuild`.
+
+## javascript insertion via meta tags
+
+Raúl Benencia discovered an additional XSS exposure in the meta plugin.
+
+This hole was discovered on 16 May 2012 and fixed the same day with
+the release of ikiwiki 3.20120516.
--
2.39.5