projects / ikiwiki.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: af63a2e)
the real bug turned out to be in the meta plugin
authorjoey <joey@0fa5a96a-9a0e-0410-b3b2-a0fd24251071>
Wed, 21 Mar 2007 06:46:06 +0000 (06:46 +0000)
committerjoey <joey@0fa5a96a-9a0e-0410-b3b2-a0fd24251071>
Wed, 21 Mar 2007 06:46:06 +0000 (06:46 +0000)
IkiWiki/Plugin/meta.pm patch | blob | history
debian/changelog patch | blob | history
po/ikiwiki.pot patch | blob | history
templates/page.tmpl patch | blob | history

diff --git a/IkiWiki/Plugin/meta.pm b/IkiWiki/Plugin/meta.pm
index d624757baead4e1f63c3ee7226d502bca4aeeec3..f71b80fb967e6b3132c435792497c175313a90e1 100644 (file)
--- a/IkiWiki/Plugin/meta.pm
+++ b/IkiWiki/Plugin/meta.pm
@@ -56,7 +56,7 @@ sub preprocess (@) { #{{{
                }
        }
        elsif ($key eq 'title') {
-               $title{$page}=$value;
+               $title{$page}=encode_entities($value);
        }
        elsif ($key eq 'permalink') {
                $permalink{$page}=$value;
diff --git a/debian/changelog b/debian/changelog
index 86815828a7038d05369cd3b34e3b5ec679ed5f65..976143aee7489021d41c2d4db28b47d51109b307 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -12,8 +12,8 @@ ikiwiki (1.46) unstable; urgency=low
     same time, and let the second person resolve the conflict.
   * Applied a patch from Michał to make the mercurial backend pass --quiet to
     hg.
-  * Fix a security hole that allowed a web user to insert
-    arbitrary html in the title of a page due to missing escaping.
+  * Fix a security hole that allowed a web user to insert arbitrary html in
+    the title of a page due to missing escaping of titles in the meta plugin.
 
  -- Joey Hess <joeyh@debian.org>  Wed, 21 Mar 2007 01:51:30 -0400
 
diff --git a/po/ikiwiki.pot b/po/ikiwiki.pot
index d4760ed3fd18762171bc09314282e46446c95bb4..2af2804aeb528fb0993d74383af512bb8eae5fba 100644 (file)
--- a/po/ikiwiki.pot
+++ b/po/ikiwiki.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2007-03-21 02:05-0400\n"
+"POT-Creation-Date: 2007-03-21 02:42-0400\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
diff --git a/templates/page.tmpl b/templates/page.tmpl
index ba6fb8c60c9bc1c3a2af0ecabc8f79c3e1a2b68c..471ed1a7d4236922f1f6e8815157571d2fe5df14 100644 (file)
--- a/templates/page.tmpl
+++ b/templates/page.tmpl
@@ -3,7 +3,7 @@
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-<title><TMPL_VAR TITLE ESCAPE=HTML></title>
+<title><TMPL_VAR TITLE></title>
 <link rel="stylesheet" href="<TMPL_VAR BASEURL>style.css" type="text/css" />
 <link rel="stylesheet" href="<TMPL_VAR BASEURL>local.css" type="text/css" />
 <TMPL_IF NAME="FAVICON">
Ikiwiki is a compiler for VCS-based (Git, Subversion, ...) wikis.