Merge branch 'master' of ssh://git.ikiwiki.info/srv/git/ikiwiki.info

diff --git a/IkiWiki/Plugin/comments.pm b/IkiWiki/Plugin/comments.pm
index 1287590a77ecb833a8a80f2b4d5a48ec12de971e..d9183970d8b1525c34a69a68dcec57fa88eaf58e 100644 (file)
--- a/IkiWiki/Plugin/comments.pm
+++ b/IkiWiki/Plugin/comments.pm
@@ -364,8 +364,8 @@ sub editcomment ($$) {
        }
 
        # The untaint is OK (as in editpage) because we're about to pass
-       # it to file_pruned anyway
-       my $page = $form->field('page');
+       # it to file_pruned and wiki_file_regexp anyway.
+       my $page = $form->field('page')=~/$config{wiki_file_regexp}/;
        $page = IkiWiki::possibly_foolish_untaint($page);
        if (! defined $page || ! length $page ||
                IkiWiki::file_pruned($page)) {

diff --git a/IkiWiki/Plugin/editpage.pm b/IkiWiki/Plugin/editpage.pm
index df29bcc98d5ba95663b57a6c252fd6a2432e0627..8c78e853cfc188927a4c1c225dca7a1267fdc7b4 100644 (file)
--- a/IkiWiki/Plugin/editpage.pm
+++ b/IkiWiki/Plugin/editpage.pm
@@ -91,12 +91,12 @@ sub cgi_editpage ($$) {
        # This untaint is safe because we check file_pruned and
        # wiki_file_regexp.
        my ($page)=$form->field('page')=~/$config{wiki_file_regexp}/;
-       $page=possibly_foolish_untaint($page);
-       my $absolute=($page =~ s#^/+##); # absolute name used to force location
        if (! defined $page || ! length $page ||
            file_pruned($page)) {
                error(gettext("bad page name"));
        }
+       $page=possibly_foolish_untaint($page);
+       my $absolute=($page =~ s#^/+##); # absolute name used to force location
 
        my $baseurl = urlto($page);
 

diff --git a/IkiWiki/Plugin/rename.pm b/IkiWiki/Plugin/rename.pm
index 57747d3c9df00141a1ade61e823c453a2ecbcc33..e871b815d6441a0cc52131932c283421c78c98c6 100644 (file)
--- a/IkiWiki/Plugin/rename.pm
+++ b/IkiWiki/Plugin/rename.pm
@@ -567,6 +567,7 @@ sub fixlinks ($$$) {
                }
                if ($needfix) {
                        my $file=$pagesources{$page};
+                       next unless -e $config{srcdir}."/".$file;
                        my $oldcontent=readfile($config{srcdir}."/".$file);
                        my $content=renamepage_hook($page, $rename->{src}, $rename->{dest}, $oldcontent);
                        if ($oldcontent ne $content) {

diff --git a/debian/changelog b/debian/changelog
index 36e4a957686a3449a176dacd676a83d0431ec9ad..bed0bd6b4b45ddf5b13cafbaace06b4c642ab9aa 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -4,6 +4,10 @@ ikiwiki (3.20110106) UNRELEASED; urgency=low
     to feed links. (Giuseppe Bilotta)
   * inline: Use class rather than id for feedlinks and blogform.
     (Giuseppe Bilotta)
+  * comments: Fix XSS security hole due to missing validation of page name.
+    (Thanks, Dave B.)
+  * rename: Fix crash when renaming a page that is linked to by a page
+    in an underlay.
 
  -- Joey Hess <joeyh@debian.org>  Thu, 06 Jan 2011 14:41:34 -0400
 

diff --git a/doc/security.mdwn b/doc/security.mdwn
index 4fa531eb14a4c842f401fee72d845c19e481c1da..e636a0e4564c26ce011ef6e49563b87b82f1f160 100644 (file)
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -453,3 +453,12 @@ preview or moderation of comments with such a configuration.
 
 These problems were discovered on 12 November 2010 and fixed the same
 hour with the release of ikiwiki 3.20101112. ([[!cve CVE-2010-1673]])
+
+## javascript insertation via insufficient checking in comments
+
+Dave B noticed that attempting to comment on an illegal page name could be
+used for an XSS attack.
+
+This hole was discovered on 22 Jan 2011 and fixed the same day with
+the release of ikiwiki 3.20110122. An upgrade is recommended for sites
+with the comments plugin enabled.