diff options
| author | http://smcv.pseudorandom.co.uk/ <http://smcv.pseudorandom.co.uk/@web> | 2010-04-06 00:55:54 +0000 |
|---|---|---|
| committer | Joey Hess <joey@finch.kitenet.net> | 2010-04-06 00:55:54 +0000 |
| commit | 1f112d570ef235416c4001605e15980b2f628da4 (patch) | |
| tree | 880033c77a7778da071837e1f32952b56e04fcd1 /doc | |
| parent | 315bcf866c490ae2041cef59f960e8021d52e840 (diff) | |
if applied, reverting this would be problematic
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/bugs/some_but_not_all_meta_fields_are_stored_escaped.mdwn | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/doc/bugs/some_but_not_all_meta_fields_are_stored_escaped.mdwn b/doc/bugs/some_but_not_all_meta_fields_are_stored_escaped.mdwn index 6a934d4eb..8e1ca42e0 100644 --- a/doc/bugs/some_but_not_all_meta_fields_are_stored_escaped.mdwn +++ b/doc/bugs/some_but_not_all_meta_fields_are_stored_escaped.mdwn @@ -31,3 +31,9 @@ Points of extra subtlety: double-escaped on any page that inlines them in `quick=yes` mode, and is rebuilt for some other reason. The failure mode is too much escaping rather than too little, so it shouldn't be a security problem. + +* Reverting this change, if applied, is more dangerous; until the wiki is + rebuilt, any titles, descriptions and GUIDs on unchanged pages that + contained markup could appear unescaped on any page that inlines them + in `quick=yes` mode, and is rebuilt for some other reason. The failure + mode here would be too little escaping, i.e. cross-site scripting. |