Bug#295515: usemod-wiki is vulnerable to XSS (CAN-2004-1397)

[Christoph Berg]

Re: To Debian Bug Tracking System in <[EMAIL PROTECTED]>
> The following patch fixes this, upload due soon.

The first patch quoted to much, update:

Index: wiki.pl
===================================================================
--- wiki.pl     (Revision 193)
+++ wiki.pl     (Arbeitskopie)
@@ -376,8 +376,13 @@
 }
 
 sub Ts {
-  my ($text, $string) = @_;
+  my ($text, $string, $noquote) = @_;
 
+  unless($noquote) {
+    $string =~ s/&/&amp;/g;
+    $string =~ s/</&lt;/g;
+    $string =~ s/>/&gt;/g;
+  }
   $text = T($text);
   $text =~ s/\%s/$string/;
   return $text;
@@ -385,9 +390,17 @@
 
 sub Tss {
   my $text = $_[0];
+  my @args = @_;
+  @args = map {
+    my $a = $_;
+    $a =~ s/&/&amp;/g;
+    $a =~ s/</&lt;/g;
+    $a =~ s/>/&gt;/g;
+    $a;
+  } @args;
 
   $text = T($text);
-  $text =~ s/\%([1-9])/$_[$1]/ge;
+  $text =~ s/\%([1-9])/$args[$1]/ge;
   return $text;
 }
 
@@ -1425,7 +1438,7 @@
     $result .= ' ' . &TimeToText($Section{ts});
     if ($AuthorFooter) {
       $result .= ' ' . Ts('by %s', &GetAuthorLink($Section{'host'},
-                                     $Section{'username'}, $Section{'id'}));
+                                     $Section{'username'}, $Section{'id'}), 1);
     }
   }
   if ($UseDiff) {
@@ -3290,7 +3303,7 @@
     print ' (', T('Your user name is'), ' ',
           &GetPageLink($userName) . ') ';
   } else {
-    print ' (', Ts('Visit %s to set your user name.', &GetPrefsLink()), ') ';
+    print ' (', Ts('Visit %s to set your user name.', &GetPrefsLink(), 1), ') 
';
   }
   print $q->submit(-name=>'Preview', -value=>T('Preview')), "\n";
   if ($isConflict) {

Christoph
-- 
[EMAIL PROTECTED] | http://www.df7cb.de/

signature.asc
Description: Digital signature