From: Joey Hess <joey@kitenet.net>
Date: Wed, 16 May 2012 23:54:41 +0000 (-0400)
Subject: meta: Security fix; add missing sanitization of author and authorurl. Thanks, Raúl... 
X-Git-Url: https://sipb.mit.edu/gitweb.cgi/ikiwiki.git/commitdiff_plain/fbfcea89f8e06426c73ab8ea369ca4cdc566db6f?ds=sidebyside

meta: Security fix; add missing sanitization of author and authorurl. Thanks, Raúl Benencia
---

diff --git a/IkiWiki/Plugin/meta.pm b/IkiWiki/Plugin/meta.pm
index b19ea2b32..c79c8ccc0 100644
--- a/IkiWiki/Plugin/meta.pm
+++ b/IkiWiki/Plugin/meta.pm
@@ -318,8 +318,8 @@ sub pagetemplate (@) {
 		$template->param(title_overridden => 1);
 	}
 
-	foreach my $field (qw{author authorurl}) {
-		$template->param($field => $pagestate{$page}{meta}{$field})
+	foreach my $field (qw{authorurl}) {
+		$template->param($field => HTML::Entities::encode_entities($pagestate{$page}{meta}{$field}))
 			if exists $pagestate{$page}{meta}{$field} && $template->query(name => $field);
 	}
 
@@ -330,7 +330,7 @@ sub pagetemplate (@) {
 		}
 	}
 
-	foreach my $field (qw{description}) {
+	foreach my $field (qw{description author}) {
 		eval q{use HTML::Entities};
 		$template->param($field => HTML::Entities::encode_numeric($pagestate{$page}{meta}{$field}))
 			if exists $pagestate{$page}{meta}{$field} && $template->query(name => $field);
diff --git a/debian/changelog b/debian/changelog
index cefbb99ed..c7e4b1d11 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+ikiwiki (3.20120516) unstable; urgency=high
+
+  * meta: Security fix; add missing sanitization of author and authorurl.
+    Thanks, Raúl Benencia
+
+ -- Joey Hess <joeyh@debian.org>  Wed, 16 May 2012 19:51:27 -0400
+
 ikiwiki (3.20120419) unstable; urgency=low
 
   * Remove dead link from plugins/teximg. Closes: #664885
diff --git a/doc/security.mdwn b/doc/security.mdwn
index b573b5f23..99f40d3f1 100644
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -482,9 +482,16 @@ Ludwig Nussel discovered a way for users to hijack root's tty when
 ikiwiki-mass-rebuild was run. Additionally, there was some potential
 for information disclosure via symlinks. ([[!cve CVE-2011-1408]])
 
-This hole was disconvered on 8 June 2011 and fixed the same day with
+This hole was discovered on 8 June 2011 and fixed the same day with
 the release of ikiwiki 3.20110608. Note that the fix is dependant on
 a version of su that has a similar hole fixed; [[!debbug 628843]]
 tracks fixing the hole in Debian's su. An upgrade is a must for any
 sites that have `ikiwiki-update-wikilist` installed suid (not the default),
 and whose admins run `ikiwiki-mass-rebuild`.
+
+## javascript insertion via meta tags
+
+Raúl Benencia discovered an additional XSS exposure in the meta plugin.
+
+This hole was discovered on 16 May 2012 and fixed the same day with
+the release of ikiwiki 3.20120516.