oh, this is confusing, it needs escaping in <title>, but not when it's used

inline, already escaped there

diff --git a/debian/changelog b/debian/changelog
index 5934958ce09b06b21fc2688109bfffc8e6e2164f..86815828a7038d05369cd3b34e3b5ec679ed5f65 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -12,9 +12,8 @@ ikiwiki (1.46) unstable; urgency=low
     same time, and let the second person resolve the conflict.
   * Applied a patch from Michał to make the mercurial backend pass --quiet to
     hg.
-  * Fix a few bugs around page titles containing html. The worst of these
-    is an actual security hole as it allows insertion of html into the title
-    element of a page, which is not processed by the htmlscrubber.
+  * Fix a security hole that allowed a web user to insert
+    arbitrary html in the title of a page due to missing escaping.
 
  -- Joey Hess <joeyh@debian.org>  Wed, 21 Mar 2007 01:51:30 -0400
 

diff --git a/po/ikiwiki.pot b/po/ikiwiki.pot
index 8f223571b72a75cb23ba44dab60e3b67cade2852..d4760ed3fd18762171bc09314282e46446c95bb4 100644 (file)
--- a/po/ikiwiki.pot
+++ b/po/ikiwiki.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2007-03-21 01:50-0400\n"
+"POT-Creation-Date: 2007-03-21 02:05-0400\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"

diff --git a/templates/archivepage.tmpl b/templates/archivepage.tmpl
index 7e8b8b8fc7aec12e99af2347f4bd24b3610bf8e8..6bc789dfb29cfe241055ac51c4c392df6a6a50a4 100644 (file)
--- a/templates/archivepage.tmpl
+++ b/templates/archivepage.tmpl
@@ -1,5 +1,5 @@
 <p>
-<a href="<TMPL_VAR PAGEURL>"><TMPL_VAR TITLE ESCAPE=HTML></a><br />
+<a href="<TMPL_VAR PAGEURL>"><TMPL_VAR TITLE></a><br />
 <i>
 Posted <TMPL_VAR CTIME>
 </i>

diff --git a/templates/inlinepage.tmpl b/templates/inlinepage.tmpl
index f1f21d4be4276ed6fbf9c347da465cb4948af719..0317c248ca1086bffc16d8199c53ed8cb12b2166 100644 (file)
--- a/templates/inlinepage.tmpl
+++ b/templates/inlinepage.tmpl
@@ -10,9 +10,9 @@
 </TMPL_IF>
 <span class="header">
 <TMPL_IF NAME="PERMALINK">
-<a href="<TMPL_VAR PERMALINK>"><TMPL_VAR TITLE ESCAPE=HTML></a>
+<a href="<TMPL_VAR PERMALINK>"><TMPL_VAR TITLE></a>
 <TMPL_ELSE>
-<a href="<TMPL_VAR PAGEURL>"><TMPL_VAR TITLE ESCAPE=HTML></a>
+<a href="<TMPL_VAR PAGEURL>"><TMPL_VAR TITLE></a>
 </TMPL_IF>
 </span>
 <TMPL_VAR CONTENT>

diff --git a/templates/titlepage.tmpl b/templates/titlepage.tmpl
index 0676a098e9b0cc7ed4a16549cc81348e093312f5..f5cd5bc53e69de301886902e25428cd2ab2c9b94 100644 (file)
--- a/templates/titlepage.tmpl
+++ b/templates/titlepage.tmpl
@@ -1 +1 @@
-<p><a href="<TMPL_VAR PAGEURL>"><TMPL_VAR TITLE ESCAPE=HTML></a></p>
+<p><a href="<TMPL_VAR PAGEURL>"><TMPL_VAR TITLE></a></p>