diff options
| author | intrigeri <intrigeri@boum.org> | 2010-12-20 14:27:21 +0100 |
|---|---|---|
| committer | intrigeri <intrigeri@boum.org> | 2010-12-20 14:27:21 +0100 |
| commit | 75196e76b627709a6ecae3fa948e1fba7928a5ce (patch) | |
| tree | 6aa2baeb9cc68f98ca256ce0ff5cb20909f52ef9 /doc/security.mdwn | |
| parent | 8c2962ec48ae57605d6d0e297be437a97b6229ca (diff) | |
| parent | e5ed3c9e3801360cc00ce4f4f325f68ac0770bff (diff) | |
Merge remote branch 'upstream/master' into prv/po
Diffstat (limited to 'doc/security.mdwn')
| -rw-r--r-- | doc/security.mdwn | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/doc/security.mdwn b/doc/security.mdwn index 34a005239..4fa531eb1 100644 --- a/doc/security.mdwn +++ b/doc/security.mdwn @@ -440,3 +440,16 @@ with the release of ikiwiki 3.20100312. A fix was also backported to Debian etch, as version 2.53.5. I recommend upgrading to one of these versions if your wiki can be edited by third parties. + +## javascript insertation via insufficient htmlscrubbing of comments + +Kevin Riggle noticed that it was not possible to configure +`htmlscrubber_skip` to scrub comments while leaving unscubbed the text +of eg, blog posts. Confusingly, setting it to "* and !comment(*)" did not +scrub comments. + +Additionally, it was discovered that comments' html was never scrubbed during +preview or moderation of comments with such a configuration. + +These problems were discovered on 12 November 2010 and fixed the same +hour with the release of ikiwiki 3.20101112. ([[!cve CVE-2010-1673]]) |