fix setup file error

[ikiwiki.git] / doc / security.mdwn

diff --git a/doc/security.mdwn b/doc/security.mdwn
index 0731ff3c5794cfe7b16f64286e1481c3d74ac836..5fda9e6787cc82b47580c3b0a0d7c32ba412cddc 100644 (file)
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -44,7 +44,7 @@ this wiki, BTW.
 
 ## svn commit logs
 
-Anyone with svn commit access can forge "web commit from foo" and make it appeat on [[RecentChanges]] like foo committed. One way to avoid this would be to limit web commits to those done by a certian user.
+Anyone with svn commit access can forge "web commit from foo" and make it appear on [[RecentChanges]] like foo committed. One way to avoid this would be to limit web commits to those done by a certian user.
 
 It's actually possible to force a whole series of svn commits to appear to have come just before yours, by forging svn log output. This could be guarded against somewhat by revision number scanning, since the forged revisions would duplicate the numbers of unforged ones. Or subversion could fix svn log to indent commit messages, which would make such forgery impossible..
 
@@ -84,7 +84,7 @@ been no problem yet.
 
 ikiwiki does not expose untrusted data to the shell. In fact it doesn't use
 system() at all, and the only use of backticks is on data supplied by the
-wiki admin. And it runs with taint checks on of course..
+wiki admin and untainted filenames. And it runs with taint checks on of course..
 
 ## cgi data security
 
@@ -109,7 +109,9 @@ Login to the wiki involves sending a password in cleartext over the net.
 Cracking the password only allows editing the wiki as that user though.
 If you care, you can use https, I suppose.
 
-# Fixed holes.
+# Fixed holes
+
+_(Unless otherwise noted, these were discovered and immediatey fixed by the ikiwiki developers.)_
 
 ## destination directory file replacement