Your message dated Sat, 17 Mar 2007 08:32:03 +0000
with message-id <[EMAIL PROTECTED]>
and subject line Bug#410338: fixed in moin 1.5.7-1
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--- Begin Message ---
Package: moin
Version: 1.5.3-1.1
Severity: important
Tags: patch, security
"Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin before
1.5.7 allow remote attackers to inject arbitrary web script or HTML via
(1) the page info, or the page name in a (2) AttachFile, (3) RenamePage,
or (4) LocalSiteMap action."
The upstream changes are visible here:
http://hg.thinkmo.de/moin/1.5?fl=28eb59256911;file=docs/CHANGES
However, LikePages was missed, and the upstream LocalSiteMap fix appears
to be incomplete. Attached is the patch I'm using in Ubuntu.
--
Kees Cook @outflux.net
diff -Nur moin-1.5.3/MoinMoin/action/AttachFile.py moin-1.5.3.new/MoinMoin/action/AttachFile.py
--- moin-1.5.3/MoinMoin/action/AttachFile.py 2006-04-05 11:58:07.000000000 -0700
+++ moin-1.5.3.new/MoinMoin/action/AttachFile.py 2007-02-09 13:03:48.636705206 -0800
@@ -275,7 +275,7 @@
str = str + "</ul>"
else:
if showheader:
- str = '%s<p>%s</p>' % (str, _("No attachments stored for %(pagename)s") % {'pagename': pagename})
+ str = '%s<p>%s</p>' % (str, _("No attachments stored for %(pagename)s") % {'pagename': wikiutil.escape(pagename)})
return str
diff -Nur moin-1.5.3/MoinMoin/action/LikePages.py moin-1.5.3.new/MoinMoin/action/LikePages.py
--- moin-1.5.3/MoinMoin/action/LikePages.py 2006-03-22 01:25:59.000000000 -0800
+++ moin-1.5.3.new/MoinMoin/action/LikePages.py 2007-02-09 13:06:13.428072725 -0800
@@ -28,14 +28,14 @@
# No matches
if not matches:
Page(request, pagename).send_page(request,
- msg = _('No pages like "%s"!') % (pagename,))
+ msg = _('No pages like "%s"!') % (wikiutil.escape(pagename),))
return
# One match - display it
if len(matches) == 1:
Page(request, matches.keys()[0]).send_page(request,
msg = _('Exactly one page like "%s" found, redirecting to page.') % (
- pagename,))
+ wikiutil.escape(pagename),))
return
# more than one match, list 'em
@@ -44,7 +44,7 @@
# This action generate data using the user language
request.setContentLanguage(request.lang)
- wikiutil.send_title(request, _('Pages like "%s"') % (pagename),
+ wikiutil.send_title(request, _('Pages like "%s"') % (wikiutil.escape(pagename)),
pagename=pagename)
# Start content - IMPORTANT - without content div, there is no
diff -Nur moin-1.5.3/MoinMoin/action/LocalSiteMap.py moin-1.5.3.new/MoinMoin/action/LocalSiteMap.py
--- moin-1.5.3/MoinMoin/action/LocalSiteMap.py 2005-09-22 09:22:09.000000000 -0700
+++ moin-1.5.3.new/MoinMoin/action/LocalSiteMap.py 2007-02-09 13:03:48.636705206 -0800
@@ -70,7 +70,7 @@
if not name: return
self.append(' ' * (5*depth))
self.append(' ' + wikiutil.link_tag(request, '%s?action=%s' %
- (wikiutil.quoteWikinameURL(name), __name__.split('.')[-1]), name))
+ (wikiutil.quoteWikinameURL(name), __name__.split('.')[-1]), wikiutil.escape(name)))
self.append(" <small>[")
self.append(Page(request, name).link_to(request, 'view'))
self.append("</small>]<br>")
diff -Nur moin-1.5.3/MoinMoin/action/RenamePage.py moin-1.5.3.new/MoinMoin/action/RenamePage.py
--- moin-1.5.3/MoinMoin/action/RenamePage.py 2005-12-18 13:09:42.000000000 -0800
+++ moin-1.5.3.new/MoinMoin/action/RenamePage.py 2007-02-09 13:03:48.636705206 -0800
@@ -148,7 +148,7 @@
'error': error,
'action': self.__class__.__name__,
'ticket': wikiutil.createTicket(),
- 'pagename': self.pagename,
+ 'pagename': wikiutil.escape(self.pagename, 1),
'rename': _('Rename Page'),
'cancel': _('Cancel'),
'newname_label': _("New name"),
diff -Nur moin-1.5.3/MoinMoin/theme/__init__.py moin-1.5.3.new/MoinMoin/theme/__init__.py
--- moin-1.5.3/MoinMoin/theme/__init__.py 2006-04-15 12:09:38.000000000 -0700
+++ moin-1.5.3.new/MoinMoin/theme/__init__.py 2007-02-09 13:03:48.636705206 -0800
@@ -628,7 +628,7 @@
info = _("last edited %(time)s by %(editor)s") % info
else:
info = _("last modified %(time)s") % info
- pagename = page.page_name
+ pagename = wikiutil.escape(page.page_name)
if self.request.cfg.show_interwiki:
pagename = "%s: %s" % (self.request.cfg.interwikiname, pagename)
info = "%s (%s)" % (pagename, info)
--- End Message ---
--- Begin Message ---
Source: moin
Source-Version: 1.5.7-1
We believe that the bug you reported is fixed in the latest version of
moin, which is due to be installed in the Debian FTP archive:
moin_1.5.7-1.diff.gz
to pool/main/m/moin/moin_1.5.7-1.diff.gz
moin_1.5.7-1.dsc
to pool/main/m/moin/moin_1.5.7-1.dsc
moin_1.5.7.orig.tar.gz
to pool/main/m/moin/moin_1.5.7.orig.tar.gz
moinmoin-common_1.5.7-1_all.deb
to pool/main/m/moin/moinmoin-common_1.5.7-1_all.deb
python-moinmoin_1.5.7-1_all.deb
to pool/main/m/moin/python-moinmoin_1.5.7-1_all.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Jonas Smedegaard <[EMAIL PROTECTED]> (supplier of updated moin package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Fri, 16 Mar 2007 18:07:48 +0100
Source: moin
Binary: moinmoin-common python-moinmoin
Architecture: source all
Version: 1.5.7-1
Distribution: unstable
Urgency: low
Maintainer: Jonas Smedegaard <[EMAIL PROTECTED]>
Changed-By: Jonas Smedegaard <[EMAIL PROTECTED]>
Description:
moinmoin-common - Python clone of WikiWiki - common data
python-moinmoin - Python clone of WikiWiki - library
Closes: 373464 373464 383841 383909 384349 410338
Changes:
moin (1.5.7-1) unstable; urgency=low
.
* New upstream release. Closes: Bug#384349.
Highlights:
+ XSS Fixes (already fixed in Debian NMU).
+ Improved LDAP authentication.
+ Various GUI editor improvements (but still buggy!).
+ Attachments can be overwritten, moved to a different page, and
referenced.
+ Various performance improvements.
+ Rendering fixes (especially workarounds for IE6 bugs).
+ Simplified migration routine. Please read
/usr/share/doc/moinmoin-common/README.Migration(.gz).
+ Fix for forgotten password email login URL.
+ Google sitemap support: ?action=sitemap.
+ Updated translations: i18n strings, system and help pages.
+ Hyphens are now allowed in usernames. Closes: Bug#383909.
+ Improved docutils and ReST support.
* Acknowledge NMUs. Closes: Bug#373464, #383841, #410338, thanks to
Josselin Mouette, Pierre Habouzit, Martin Zobel-Helas and Toni
Mueller.
* Reorganize patches.
+ Extend patches to 5 digits to make room for Hg changesets.
+ Adjust debian/patches/README to mention Hg (not Arch).
+ Use quilt (not the simple cdbs-internal patch system).
* Add patches to bring in sync with upstream Hg (patchset 822).
* Remove parts of CVE-2007-0857 applied upstream (changesets 805-806).
Rename patch to follow new 5-digit scheme.
* Rewrite README.packaging to describe getting changesets from Hg (not
Arch).
* Update CDBS tweaks:
+ Update copyright-check.mk: Look for "(c)" too, avoid non-printable
characters, verbose error report.
+ Update buildinfo.mk: Fix touchfile to run only once.
+ Major overhaul of python-distutils.mk: Syncronize with main cdbs,
which adds support for new Python policy, and massive rewrite to
bring back functionality broken in the default implementation of
that new policy.
+ Replace auto-update.mk with (overload of) buildcore.mk.
+ Add README.cdbs-tweaks documenting the added tweaks.
+ Advertise README.cdbs-tweaks in debian/rules.
* Enable new Python policy, except when DEB_BUILD_OPTIONS contains
"sarge". Closes: Bug#373464 (thanks to Pierre Habouzit and ).
* Bump up Standards-Version to 3.7.2 for non-default distros.
* Adjust long description to not mention dropped pythonXX-moinmoin.
* As stated in README.Debian, CGI interface has had most testing:
+ Revert to suggesting apache in favor of libapache(2)-python.
+ Suggest httpd-cgi (not httpd) as fallback.
* Cleanup and improve debian/rules:
+ Use (newly improved!) tweaked cdbs again, to also support
distributions using the old python policy.
+ Restore rules aaplying only to old python policy.
+ Add switch to declare variables varying between python policies.
+ Stitch together README.Debian from parts, referring to build-
dependent default python version, and leaving out section on
multiple packages when using new python policy.
+ Stitch together README.Debian and moinmoin-common.postinst in
pre-build, and remove in clean. This avoids distributing changes
and then loosing it again automatically at next build.
+ Add more comments.
+ Move build targets to switch distribution down to the bottom.
* Update debian/copyright:
+ Add new copyright for Bubblehelp infoboxes (license: GPLv2).
+ Add new copyright for EXIF filter (license: BSD-like).
+ Fix non-unicode Character (copyright-holder Peter Ã
strand).
* No longer install docs/CHANGES.config dropped upstream.
* Add note to README.Debian about risk of dict symlink breaking if
copying and using the data from a different location. This relates
only to the recent NMU changing (without documentaing!!!) from
static to shared symlink.
* Use Build-depends (not Build-depends-Indep) for non-default
distributions.
* Tightened pyversions to only include 2.3 and higher.
* Suppress lintian warnings about INSTALL.html in docs (contains
valuable info on further steps than automated in this packaging) and
non-executable scripts in underlay (they should never be executed
from there).
Files:
3af73028d18bbf049565ee975c3ccb5c 759 net optional moin_1.5.7-1.dsc
b304f1c2054c7f3bf0dc48c141b28b33 4411634 net optional moin_1.5.7.orig.tar.gz
5ee74fe0319d707c71c9c481f4a21b12 48877 net optional moin_1.5.7-1.diff.gz
3a2a526a20eaaa225cb237a666b8aee5 1660388 net optional
moinmoin-common_1.5.7-1_all.deb
a89395b1e9ea7d4b4cb9ab32522bde80 1017220 python optional
python-moinmoin_1.5.7-1_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFF+yqSn7DbMsAkQLgRAvECAJ9fbh7g5OMAhLy8xNSmlBdzVf6GsACfRK6H
QjmU9th+UdcQKyQDqERRCs0=
=742I
-----END PGP SIGNATURE-----
--- End Message ---