From 03e54381556d95b7d6bcbc8eb5442e40c0537c09 Mon Sep 17 00:00:00 2001 From: joey Date: Wed, 21 Mar 2007 06:22:06 +0000 Subject: oh, this is confusing, it needs escaping in , but not when it's used inline, already escaped there --- debian/changelog | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) (limited to 'debian') diff --git a/debian/changelog b/debian/changelog index 5934958ce..86815828a 100644 --- a/debian/changelog +++ b/debian/changelog @@ -12,9 +12,8 @@ ikiwiki (1.46) unstable; urgency=low same time, and let the second person resolve the conflict. * Applied a patch from Michał to make the mercurial backend pass --quiet to hg. - * Fix a few bugs around page titles containing html. The worst of these - is an actual security hole as it allows insertion of html into the title - element of a page, which is not processed by the htmlscrubber. + * Fix a security hole that allowed a web user to insert + arbitrary html in the title of a page due to missing escaping. -- Joey Hess <joeyh@debian.org> Wed, 21 Mar 2007 01:51:30 -0400 -- cgit v1.2.3