diff options
| -rw-r--r-- | IkiWiki/Plugin/comments.pm | 4 | ||||
| -rw-r--r-- | IkiWiki/Plugin/editpage.pm | 4 | ||||
| -rw-r--r-- | IkiWiki/Plugin/rename.pm | 1 | ||||
| -rw-r--r-- | debian/changelog | 4 | ||||
| -rw-r--r-- | doc/security.mdwn | 9 |
5 files changed, 18 insertions, 4 deletions
diff --git a/IkiWiki/Plugin/comments.pm b/IkiWiki/Plugin/comments.pm index 1287590a7..d9183970d 100644 --- a/IkiWiki/Plugin/comments.pm +++ b/IkiWiki/Plugin/comments.pm @@ -364,8 +364,8 @@ sub editcomment ($$) { } # The untaint is OK (as in editpage) because we're about to pass - # it to file_pruned anyway - my $page = $form->field('page'); + # it to file_pruned and wiki_file_regexp anyway. + my $page = $form->field('page')=~/$config{wiki_file_regexp}/; $page = IkiWiki::possibly_foolish_untaint($page); if (! defined $page || ! length $page || IkiWiki::file_pruned($page)) { diff --git a/IkiWiki/Plugin/editpage.pm b/IkiWiki/Plugin/editpage.pm index df29bcc98..8c78e853c 100644 --- a/IkiWiki/Plugin/editpage.pm +++ b/IkiWiki/Plugin/editpage.pm @@ -91,12 +91,12 @@ sub cgi_editpage ($$) { # This untaint is safe because we check file_pruned and # wiki_file_regexp. my ($page)=$form->field('page')=~/$config{wiki_file_regexp}/; - $page=possibly_foolish_untaint($page); - my $absolute=($page =~ s#^/+##); # absolute name used to force location if (! defined $page || ! length $page || file_pruned($page)) { error(gettext("bad page name")); } + $page=possibly_foolish_untaint($page); + my $absolute=($page =~ s#^/+##); # absolute name used to force location my $baseurl = urlto($page); diff --git a/IkiWiki/Plugin/rename.pm b/IkiWiki/Plugin/rename.pm index 57747d3c9..e871b815d 100644 --- a/IkiWiki/Plugin/rename.pm +++ b/IkiWiki/Plugin/rename.pm @@ -567,6 +567,7 @@ sub fixlinks ($$$) { } if ($needfix) { my $file=$pagesources{$page}; + next unless -e $config{srcdir}."/".$file; my $oldcontent=readfile($config{srcdir}."/".$file); my $content=renamepage_hook($page, $rename->{src}, $rename->{dest}, $oldcontent); if ($oldcontent ne $content) { diff --git a/debian/changelog b/debian/changelog index 36e4a9576..bed0bd6b4 100644 --- a/debian/changelog +++ b/debian/changelog @@ -4,6 +4,10 @@ ikiwiki (3.20110106) UNRELEASED; urgency=low to feed links. (Giuseppe Bilotta) * inline: Use class rather than id for feedlinks and blogform. (Giuseppe Bilotta) + * comments: Fix XSS security hole due to missing validation of page name. + (Thanks, Dave B.) + * rename: Fix crash when renaming a page that is linked to by a page + in an underlay. -- Joey Hess <joeyh@debian.org> Thu, 06 Jan 2011 14:41:34 -0400 diff --git a/doc/security.mdwn b/doc/security.mdwn index 4fa531eb1..e636a0e45 100644 --- a/doc/security.mdwn +++ b/doc/security.mdwn @@ -453,3 +453,12 @@ preview or moderation of comments with such a configuration. These problems were discovered on 12 November 2010 and fixed the same hour with the release of ikiwiki 3.20101112. ([[!cve CVE-2010-1673]]) + +## javascript insertation via insufficient checking in comments + +Dave B noticed that attempting to comment on an illegal page name could be +used for an XSS attack. + +This hole was discovered on 22 Jan 2011 and fixed the same day with +the release of ikiwiki 3.20110122. An upgrade is recommended for sites +with the comments plugin enabled. |