if applied, reverting this would be problematic

[ikiwiki.git] / doc / bugs / some_but_not_all_meta_fields_are_stored_escaped.mdwn

diff --git a/doc/bugs/some_but_not_all_meta_fields_are_stored_escaped.mdwn b/doc/bugs/some_but_not_all_meta_fields_are_stored_escaped.mdwn
index 6a934d4eb937252ac6408c36c3504883aa9d47a8..8e1ca42e04432e4d32282e344c6dca9a3afb9c3a 100644 (file)
--- a/doc/bugs/some_but_not_all_meta_fields_are_stored_escaped.mdwn
+++ b/doc/bugs/some_but_not_all_meta_fields_are_stored_escaped.mdwn
@@ -31,3 +31,9 @@ Points of extra subtlety:
   double-escaped on any page that inlines them in `quick=yes` mode, and
   is rebuilt for some other reason. The failure mode is too much escaping
   rather than too little, so it shouldn't be a security problem.
+
+* Reverting this change, if applied, is more dangerous; until the wiki is
+  rebuilt, any titles, descriptions and GUIDs on unchanged pages that
+  contained markup could appear unescaped on any page that inlines them
+  in `quick=yes` mode, and is rebuilt for some other reason. The failure
+  mode here would be too little escaping, i.e. cross-site scripting.