summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--IkiWiki/CGI.pm35
-rw-r--r--debian/changelog3
-rw-r--r--doc/bugs/perl:_double_free_or_corruption.mdwn101
-rw-r--r--doc/security.mdwn13
-rw-r--r--po/ikiwiki.pot28
-rw-r--r--templates/editpage.tmpl1
6 files changed, 69 insertions, 112 deletions
diff --git a/IkiWiki/CGI.pm b/IkiWiki/CGI.pm
index 470677088..65136a269 100644
--- a/IkiWiki/CGI.pm
+++ b/IkiWiki/CGI.pm
@@ -161,8 +161,18 @@ sub cgi_prefs ($$) { #{{{
my $session=shift;
needsignin($q, $session);
-
decode_cgi_utf8($q);
+
+ # The session id is stored on the form and checked to
+ # guard against CSRF.
+ my $sid=$q->param('sid');
+ if (! defined $sid) {
+ $q->delete_all;
+ }
+ elsif ($sid ne $session->id) {
+ error(gettext("Your login session has expired."));
+ }
+
eval q{use CGI::FormBuilder};
error($@) if $@;
my $form = CGI::FormBuilder->new(
@@ -193,7 +203,10 @@ sub cgi_prefs ($$) { #{{{
buttons => $buttons);
});
- $form->field(name => "do", type => "hidden");
+ $form->field(name => "do", type => "hidden", value => "prefs",
+ force => 1);
+ $form->field(name => "sid", type => "hidden", value => $session->id,
+ force => 1);
$form->field(name => "email", size => 50, fieldset => "preferences");
$form->field(name => "banned_users", size => 50,
fieldset => "admin");
@@ -241,11 +254,11 @@ sub cgi_prefs ($$) { #{{{
sub cgi_editpage ($$) { #{{{
my $q=shift;
my $session=shift;
-
- my @fields=qw(do rcsinfo subpage from page type editcontent comments);
- my @buttons=("Save Page", "Preview", "Cancel");
decode_cgi_utf8($q);
+
+ my @fields=qw(do rcsinfo subpage from page type editcontent comments);
+ my @buttons=("Save Page", "Preview", "Cancel");
eval q{use CGI::FormBuilder};
error($@) if $@;
my $form = CGI::FormBuilder->new(
@@ -316,6 +329,8 @@ sub cgi_editpage ($$) { #{{{
}
$form->field(name => "do", type => 'hidden');
+ $form->field(name => "sid", type => "hidden", value => $session->id,
+ force => 1);
$form->field(name => "from", type => 'hidden');
$form->field(name => "rcsinfo", type => 'hidden');
$form->field(name => "subpage", type => 'hidden');
@@ -474,6 +489,16 @@ sub cgi_editpage ($$) { #{{{
else {
# save page
check_canedit($page, $q, $session);
+
+ # The session id is stored on the form and checked to
+ # guard against CSRF. But only if the user is logged in,
+ # as anonok can allow anonymous edits.
+ if (defined $session->param("name")) {
+ my $sid=$q->param('sid');
+ if (! defined $sid || $sid ne $session->id) {
+ error(gettext("Your login session has expired."));
+ }
+ }
my $exists=-e "$config{srcdir}/$file";
diff --git a/debian/changelog b/debian/changelog
index 613640f60..9085d97cb 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -3,6 +3,9 @@ ikiwiki (2.42) UNRELEASED; urgency=low
* aggregate: Correct a mistake in the code that dummy up a guid for feeds
lacking one.
* inline: Correct handling of urls relative to baseurl in feeds.
+ * Fix CSRF attacks against the preferences and edit forms. The fix involved
+ embedding the session id in the forms, and not allowing the forms to be
+ submitted if the embedded id does not match the session id. Closes: #475445
-- Joey Hess <joeyh@debian.org> Thu, 03 Apr 2008 02:35:39 -0400
diff --git a/doc/bugs/perl:_double_free_or_corruption.mdwn b/doc/bugs/perl:_double_free_or_corruption.mdwn
index 4101fc2e9..8499b6388 100644
--- a/doc/bugs/perl:_double_free_or_corruption.mdwn
+++ b/doc/bugs/perl:_double_free_or_corruption.mdwn
@@ -1,101 +1,14 @@
+If your perl is dumping core, that's a perl bug (or a libc bug or the like) by
+definition, not an ikiwiki bug. Ikiwiki is pure perl code; pure perl code
+can't cause perl to dump core unless it tickles a perl bug.
+
+Calling this [[done]] since this is not the right forum. You'll need to
+figure out what's wrong with your perl, I'm afraid. --[[Joey]]
+
<pre>
rendering todo/more_class__61____34____34___for_css.mdwn
rendering todo/Support_subdirectory_of_a_git_repo.mdwn
rendering todo/link_map.mdwn
rendering todo/calendar_--_archive_browsing_via_a_calendar_frontend.mdwn
*** glibc detected *** perl: double free or corruption (!prev): 0x00000000018a7bd0 ***
-======= Backtrace: =========
-/lib/libc.so.6[0x2b2ebbe69b0a]
-/lib/libc.so.6(cfree+0x8c)[0x2b2ebbe6d6fc]
-/usr/lib/libperl.so.5.8(Perl_pregfree+0x69)[0x2b2ebb4886c9]
-/usr/lib/libperl.so.5.8(Perl_pp_regcomp+0xed)[0x2b2ebb4e3b8d]
-/usr/lib/libperl.so.5.8(Perl_runops_standard+0xe)[0x2b2ebb4a91ee]
-/usr/lib/libperl.so.5.8(Perl_call_sv+0x650)[0x2b2ebb4535b0]
-/usr/lib/libperl.so.5.8(Perl_call_list+0x229)[0x2b2ebb453929]
-/usr/lib/libperl.so.5.8(Perl_newATTRSUB+0xe54)[0x2b2ebb484fd4]
-/usr/lib/libperl.so.5.8(Perl_utilize+0x254)[0x2b2ebb483654]
-/usr/lib/libperl.so.5.8(Perl_yyparse+0x17a9)[0x2b2ebb475bf9]
-/usr/lib/libperl.so.5.8[0x2b2ebb4da416]
-/usr/lib/libperl.so.5.8(Perl_pp_entereval+0x4cc)[0x2b2ebb4dadec]
-/usr/lib/libperl.so.5.8(Perl_runops_standard+0xe)[0x2b2ebb4a91ee]
-/usr/lib/libperl.so.5.8(perl_run+0x30a)[0x2b2ebb453f4a]
-perl(main+0xfc)[0x4018dc]
-/lib/libc.so.6(__libc_start_main+0xf4)[0x2b2ebbe15b44]
-perl[0x401749]
-======= Memory map: ========
-00400000-00403000 r-xp 00000000 09:02 1273874 /usr/bin/perl
-00602000-00603000 rw-p 00002000 09:02 1273874 /usr/bin/perl
-00603000-019a7000 rw-p 00603000 00:00 0 [heap]
-2b2ebb1fd000-2b2ebb21a000 r-xp 00000000 09:02 1043912 /lib/ld-2.6.1.so
-2b2ebb21a000-2b2ebb21d000 rw-p 2b2ebb21a000 00:00 0
-2b2ebb21d000-2b2ebb21e000 r--p 00000000 09:02 1304528 /usr/lib/locale/en_US.utf8/LC_IDENTIFICATION
-2b2ebb21e000-2b2ebb225000 r--s 00000000 09:02 1271442 /usr/lib/gconv/gconv-modules.cache
-2b2ebb225000-2b2ebb226000 r--p 00000000 09:02 1304527 /usr/lib/locale/en_US.utf8/LC_MEASUREMENT
-2b2ebb226000-2b2ebb227000 r--p 00000000 09:02 1304526 /usr/lib/locale/en_US.utf8/LC_TELEPHONE
-2b2ebb227000-2b2ebb228000 r--p 00000000 09:02 1304525 /usr/lib/locale/en_US.utf8/LC_ADDRESS
-2b2ebb228000-2b2ebb229000 r--p 00000000 09:02 1304524 /usr/lib/locale/en_US.utf8/LC_NAME
-2b2ebb229000-2b2ebb22a000 r--p 00000000 09:02 1304523 /usr/lib/locale/en_US.utf8/LC_PAPER
-2b2ebb22a000-2b2ebb22b000 r--p 00000000 09:02 1304522 /usr/lib/locale/en_US.utf8/LC_MESSAGES/SYS_LC_MESSAGES
-2b2ebb22b000-2b2ebb22c000 r--p 00000000 09:02 1304520 /usr/lib/locale/en_US.utf8/LC_MONETARY
-2b2ebb22c000-2b2ebb30c000 r--p 00000000 09:02 1304519 /usr/lib/locale/en_US.utf8/LC_COLLATE
-2b2ebb30c000-2b2ebb30d000 r--p 00000000 09:02 1304518 /usr/lib/locale/en_US.utf8/LC_TIME
-2b2ebb30d000-2b2ebb30e000 r--p 00000000 09:02 1304517 /usr/lib/locale/en_US.utf8/LC_NUMERIC
-2b2ebb30e000-2b2ebb34d000 r--p 00000000 09:02 1304516 /usr/lib/locale/en_US.utf8/LC_CTYPE
-2b2ebb34d000-2b2ebb36e000 rw-p 2b2ebb34d000 00:00 0
-2b2ebb419000-2b2ebb41b000 rw-p 0001c000 09:02 1043912 /lib/ld-2.6.1.so
-2b2ebb41b000-2b2ebb54d000 r-xp 00000000 09:02 1273924 /usr/lib/libperl.so.5.8.8
-2b2ebb54d000-2b2ebb74c000 ---p 00132000 09:02 1273924 /usr/lib/libperl.so.5.8.8
-2b2ebb74c000-2b2ebb755000 rw-p 00131000 09:02 1273924 /usr/lib/libperl.so.5.8.8
-2b2ebb755000-2b2ebb757000 rw-p 2b2ebb755000 00:00 0
-2b2ebb757000-2b2ebb759000 r-xp 00000000 09:02 1043918 /lib/libdl-2.6.1.so
-2b2ebb759000-2b2ebb959000 ---p 00002000 09:02 1043918 /lib/libdl-2.6.1.so
-2b2ebb959000-2b2ebb95b000 rw-p 00002000 09:02 1043918 /lib/libdl-2.6.1.so
-2b2ebb95b000-2b2ebb9db000 r-xp 00000000 09:02 1043919 /lib/libm-2.6.1.so
-2b2ebb9db000-2b2ebbbda000 ---p 00080000 09:02 1043919 /lib/libm-2.6.1.so
-2b2ebbbda000-2b2ebbbdc000 rw-p 0007f000 09:02 1043919 /lib/libm-2.6.1.so
-2b2ebbbdc000-2b2ebbbf2000 r-xp 00000000 09:02 1043929 /lib/libpthread-2.6.1.so
-2b2ebbbf2000-2b2ebbdf1000 ---p 00016000 09:02 1043929 /lib/libpthread-2.6.1.so
-2b2ebbdf1000-2b2ebbdf3000 rw-p 00015000 09:02 1043929 /lib/libpthread-2.6.1.so
-2b2ebbdf3000-2b2ebbdf8000 rw-p 2b2ebbdf3000 00:00 0
-2b2ebbdf8000-2b2ebbf4a000 r-xp 00000000 09:02 1043915 /lib/libc-2.6.1.so
-2b2ebbf4a000-2b2ebc149000 ---p 00152000 09:02 1043915 /lib/libc-2.6.1.so
-2b2ebc149000-2b2ebc14c000 r--p 00151000 09:02 1043915 /lib/libc-2.6.1.so
-2b2ebc14c000-2b2ebc14e000 rw-p 00154000 09:02 1043915 /lib/libc-2.6.1.so
-2b2ebc14e000-2b2ebc153000 rw-p 2b2ebc14e000 00:00 0
-2b2ebc153000-2b2ebc158000 r-xp 00000000 09:02 1043917 /lib/libcrypt-2.6.1.so
-2b2ebc158000-2b2ebc357000 ---p 00005000 09:02 1043917 /lib/libcrypt-2.6.1.so
-2b2ebc357000-2b2ebc359000 rw-p 00004000 09:02 1043917 /lib/libcrypt-2.6.1.so
-2b2ebc359000-2b2ebc389000 rw-p 2b2ebc359000 00:00 0
-2b2ebc389000-2b2ebc392000 r-xp 00000000 09:02 1288562 /usr/lib/perl/5.8.8/auto/Encode/Encode.so
-2b2ebc392000-2b2ebc592000 ---p 00009000 09:02 1288562 /usr/lib/perl/5.8.8/auto/Encode/Encode.so
-2b2ebc592000-2b2ebc593000 rw-p 00009000 09:02 1288562 /usr/lib/perl/5.8.8/auto/Encode/Encode.so
-2b2ebc593000-2b2ebc59e000 r-xp 00000000 09:02 1353260 /usr/lib/perl5/auto/HTML/Parser/Parser.so
-2b2ebc59e000-2b2ebc79d000 ---p 0000b000 09:02 1353260 /usr/lib/perl5/auto/HTML/Parser/Parser.so
-2b2ebc79d000-2b2ebc79e000 rw-p 0000a000 09:02 1353260 /usr/lib/perl5/auto/HTML/Parser/Parser.so
-2b2ebc79e000-2b2ebc7bb000 r-xp 00000000 09:02 1273917 /usr/lib/perl/5.8.8/auto/POSIX/POSIX.so
-2b2ebc7bb000-2b2ebc9ba000 ---p 0001d000 09:02 1273917 /usr/lib/perl/5.8.8/auto/POSIX/POSIX.so
-2b2ebc9ba000-2b2ebc9bb000 rw-p 0001c000 09:02 1273917 /usr/lib/perl/5.8.8/auto/POSIX/POSIX.so
-2b2ebc9bb000-2b2ebc9bd000 r-xp 00000000 09:02 1273900 /usr/lib/perl/5.8.8/auto/Cwd/Cwd.so
-2b2ebc9bd000-2b2ebcbbd000 ---p 00002000 09:02 1273900 /usr/lib/perl/5.8.8/auto/Cwd/Cwd.so
-2b2ebcbbd000-2b2ebcbbe000 rw-p 00002000 09:02 1273900 /usr/lib/perl/5.8.8/auto/Cwd/Cwd.so
-2b2ebcbbe000-2b2ebcbc5000 r-xp 00000000 09:02 1288552 /usr/lib/perl/5.8.8/auto/Data/Dumper/Dumper.so
-2b2ebcbc5000-2b2ebcdc5000 ---p 00007000 09:02 1288552 /usr/lib/perl/5.8.8/auto/Data/Dumper/Dumper.so
-2b2ebcdc5000-2b2ebcdc6000 rw-p 00007000 09:02 1288552 /usr/lib/perl/5.8.8/auto/Data/Dumper/Dumper.so
-2b2ebcdc6000-2b2ebcdca000 r-xp 00000000 09:02 1271309 /usr/lib/perl5/auto/Locale/gettext/gettext.so
-2b2ebcdca000-2b2ebcfca000 ---p 00004000 09:02 1271309 /usr/lib/perl5/auto/Locale/gettext/gettext.so
-2b2ebcfca000-2b2ebcfcb000 rw-p 00004000 09:02 1271309 /usr/lib/perl5/auto/Locale/gettext/gettext.so
-2b2ebcfcb000-2b2ebcfcf000 r-xp 00000000 09:02 1288560 /usr/lib/perl/5.8.8/auto/Digest/MD5/MD5.so
-2b2ebcfcf000-2b2ebd1ce000 ---p 00004000 09:02 1288560 /usr/lib/perl/5.8.8/auto/Digest/MD5/MD5.so
-2b2ebd1ce000-2b2ebd1cf000 rw-p 00003000 09:02 1288560 /usr/lib/perl/5.8.8/auto/Digest/MD5/MD5.so
-2b2ebd1cf000-2b2ebd1d8000 r-xp 00000000 09:02 1273914 /usr/lib/perl/5.8.8/auto/List/Util/Util.so
-2b2ebd1d8000-2b2ebd3d7000 ---p 00009000 09:02 1273914 /usr/lib/perl/5.8.8/auto/List/Util/Util.so
-2b2ebd3d7000-2b2ebd3d8000 rw-p 00008000 09:02 1273914 /usr/lib/perl/5.8.8/auto/List/Util/Util.so
-2b2ebd3ec000-2b2ebd3f9000 r-xp 00000000 09:02 1042446 /lib/libgcc_s.so.1
-2b2ebd3f9000-2b2ebd5f9000 ---p 0000d000 09:02 1042446 /lib/libgcc_s.so.1
-2b2ebd5f9000-2b2ebd5fa000 rw-p 0000d000 09:02 1042446 /lib/libgcc_s.so.1
-2b2ec0000000-2b2ec0021000 rw-p 2b2ec0000000 00:00 0
-2b2ec0021000-2b2ec4000000 ---p 2b2ec0021000 00:00 0
-7fffef824000-7fffef8ad000 rw-p 7fffef824000 00:00 0 [stack]
-ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vdso]
-make: *** [extra_build] Aborted (core dumped)
</pre>
diff --git a/doc/security.mdwn b/doc/security.mdwn
index 723daeccc..29ae7d4b3 100644
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -149,7 +149,7 @@ option.
## XSS holes in CGI output
-ikiwiki has not yet been audited to ensure that all cgi script input/output
+ikiwiki has been audited to ensure that all cgi script input/output
is sanitised to prevent XSS attacks. For example, a user can't register
with a username containing html code (anymore).
@@ -366,3 +366,14 @@ with the release of ikiwiki 2.31.1. (And a few subsequent versions..)
A fix was also backported to Debian etch, as version 1.33.4. I recommend
upgrading to one of these versions if your wiki can be edited by third
parties.
+
+## Cross Site Request Forging
+
+Cross Site Request Forging could be used to constuct a link that would
+change a logged-in user's password or other preferences if they clicked on
+the link. It could also be used to construct a link that would cause a wiki
+page to be modified by a logged-in user.
+
+These holes were discovered on 10 April 2008 and fixed the same day with
+the release of ikiwiki 2.42. A fix was also backported to Debian etch, as
+version 1.33.4. I recommend upgrading to one of these versions.
diff --git a/po/ikiwiki.pot b/po/ikiwiki.pot
index a3f7cafcb..5e7e4b4d4 100644
--- a/po/ikiwiki.pot
+++ b/po/ikiwiki.pot
@@ -8,7 +8,7 @@ msgid ""
msgstr ""
"Project-Id-Version: PACKAGE VERSION\n"
"Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2008-03-29 21:01-0400\n"
+"POT-Creation-Date: 2008-04-10 16:18-0400\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: LANGUAGE <LL@li.org>\n"
@@ -24,46 +24,50 @@ msgstr ""
msgid "login failed, perhaps you need to turn on cookies?"
msgstr ""
-#: ../IkiWiki/CGI.pm:184
+#: ../IkiWiki/CGI.pm:173 ../IkiWiki/CGI.pm:499
+msgid "Your login session has expired."
+msgstr ""
+
+#: ../IkiWiki/CGI.pm:194
msgid "Login"
msgstr ""
-#: ../IkiWiki/CGI.pm:185
+#: ../IkiWiki/CGI.pm:195
msgid "Preferences"
msgstr ""
-#: ../IkiWiki/CGI.pm:186
+#: ../IkiWiki/CGI.pm:196
msgid "Admin"
msgstr ""
-#: ../IkiWiki/CGI.pm:235
+#: ../IkiWiki/CGI.pm:248
msgid "Preferences saved."
msgstr ""
-#: ../IkiWiki/CGI.pm:293
+#: ../IkiWiki/CGI.pm:306
#, perl-format
msgid "%s is not an editable page"
msgstr ""
-#: ../IkiWiki/CGI.pm:395 ../IkiWiki/Plugin/brokenlinks.pm:24
+#: ../IkiWiki/CGI.pm:410 ../IkiWiki/Plugin/brokenlinks.pm:24
#: ../IkiWiki/Plugin/inline.pm:265 ../IkiWiki/Plugin/opendiscussion.pm:17
#: ../IkiWiki/Plugin/orphans.pm:28 ../IkiWiki/Render.pm:95
#: ../IkiWiki/Render.pm:172
msgid "discussion"
msgstr ""
-#: ../IkiWiki/CGI.pm:451
+#: ../IkiWiki/CGI.pm:466
#, perl-format
msgid "creating %s"
msgstr ""
-#: ../IkiWiki/CGI.pm:469 ../IkiWiki/CGI.pm:487 ../IkiWiki/CGI.pm:497
-#: ../IkiWiki/CGI.pm:531 ../IkiWiki/CGI.pm:576
+#: ../IkiWiki/CGI.pm:484 ../IkiWiki/CGI.pm:512 ../IkiWiki/CGI.pm:522
+#: ../IkiWiki/CGI.pm:556 ../IkiWiki/CGI.pm:601
#, perl-format
msgid "editing %s"
msgstr ""
-#: ../IkiWiki/CGI.pm:666
+#: ../IkiWiki/CGI.pm:691
msgid "You are banned."
msgstr ""
@@ -222,7 +226,7 @@ msgstr ""
msgid "Discussion"
msgstr ""
-#: ../IkiWiki/Plugin/inline.pm:491
+#: ../IkiWiki/Plugin/inline.pm:500
msgid "RPC::XML::Client not found, not pinging"
msgstr ""
diff --git a/templates/editpage.tmpl b/templates/editpage.tmpl
index cf4950ead..b0bb0ecb9 100644
--- a/templates/editpage.tmpl
+++ b/templates/editpage.tmpl
@@ -41,6 +41,7 @@ together before saving.
</TMPL_IF>
<TMPL_VAR FORM-START>
<TMPL_VAR FIELD-DO>
+<TMPL_VAR FIELD-SID>
<TMPL_VAR FIELD-FROM>
<TMPL_VAR FIELD-RCSINFO>
<TMPL_VAR FIELD-NEWFILE>
generated by cgit v1.2.3 (git 2.46.0) at 2025-03-31 04:28:48 +0000