From efe91335c65b96f3eb8b32d8c58c9cce68db47b4 Mon Sep 17 00:00:00 2001 From: joey Date: Wed, 29 Mar 2006 18:50:36 +0000 Subject: improve fix for symlink attacks to check subdirectories for symlinks too before writing --- doc/security.mdwn | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'doc') diff --git a/doc/security.mdwn b/doc/security.mdwn index 0f8861d0d..3743adea1 100644 --- a/doc/security.mdwn +++ b/doc/security.mdwn @@ -161,7 +161,8 @@ page from the web, which follows the symlink when reading the page, and again when saving the changed page. This was fixed by making ikiwiki refuse to read or write to files that are -symlinks, combined with the above locking. +symlinks, or that are in subdirectories that are symlinks, combined with +the above locking. ## underlaydir override attacks -- cgit v1.2.3