summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorwww-data <www-data@0fa5a96a-9a0e-0410-b3b2-a0fd24251071>2006-03-11 06:02:51 +0000
committerwww-data <www-data@0fa5a96a-9a0e-0410-b3b2-a0fd24251071>2006-03-11 06:02:51 +0000
commitdce2ce40e828e46613926025768f38e47993c61e (patch)
tree39f7a801df3241c068780def4e2cd42a119c33be
parent8440a771c10c20c4be0a65a50c8bf05754e3fd4d (diff)
web commit from 66.118.98.137:
-rw-r--r--doc/security.mdwn4
1 files changed, 4 insertions, 0 deletions
diff --git a/doc/security.mdwn b/doc/security.mdwn
index a3e387218..e25cc9ce9 100644
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -92,3 +92,7 @@ to the html pages, etc.
If the wrapper script is made suid, then any bugs in this wrapper would be
security holes. The wrapper is written as securely as I know how, is based on code that has a history of security use long before ikiwiki, and there's been no problem yet.
+
+## shell exploits
+
+ikiwiki does not expose untrusted data to the shell. In fact it doesn't use system() at all, and the only use of backticks is on data supplied by the wiki admin. And it runs with taint checks on of course.. \ No newline at end of file