releasing version 3.20110328

[ikiwiki.git] / doc / security.mdwn

diff --git a/doc/security.mdwn b/doc/security.mdwn
index 770927e26d1f5b607953132f77ae5ebed6004c05..53222a3a63d4a352b842f4aed006ca6484376b60 100644 (file)
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -22,8 +22,8 @@ this would be to limit web commits to those done by a certain user.
 
 ## other stuff to look at
 
-I need to audit the git backend a bit, and have been meaning to
-see if any CRLF injection type things can be done in the CGI code.
+I have been meaning to see if any CRLF injection type things can be
+done in the CGI code.
 
 ----
 
@@ -463,3 +463,14 @@ This hole was discovered on 22 Jan 2011 and fixed the same day with
 the release of ikiwiki 3.20110122. A fix was backported to Debian squeeze,
 as version 3.20100815.5. An upgrade is recommended for sites
 with the comments plugin enabled. ([[!cve CVE-2011-0428]])
+
+## possible javascript insertion via insufficient htmlscrubbing of alternate stylesheets
+
+Tango noticed that 'meta stylesheet` directives allowed anyone
+who could upload a malicious stylesheet to a site to add it to a
+page as an alternate stylesheet. In order to be exploited, the user
+would have to select the alternative stylesheet in their browser.
+
+This hole was discovered on 28 Mar 2011 and fixed the same hour with
+the release of ikiwiki 3.20110328. An upgrade is recommended for sites
+that have untrusted committers, or have the attachments plugin enabled.