<div class="gmail_quote">On Sun, May 9, 2010 at 6:45 PM, Petko Yotov <span dir="ltr"><<a href="mailto:5ko@free.fr">5ko@free.fr</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
On Sunday 09 May 2010 23:33:20, <a href="mailto:kirpi@kirpi.it">kirpi@kirpi.it</a> wrote :<br>
<div class="im">> Just found: <a href="http://twitter.com/mushy99/statuses/13634155996" target="_blank">http://twitter.com/mushy99/statuses/13634155996</a><br>
> Is it of any interest?<br>
><br>
<br>
</div>Indeed, that's a way to insert potentially harmful JavaScripts in the page. I<br>
have immediately fixed it and just released version 2.2.16.<br></blockquote></div><br>Did that vulnerability exist in all previous versions of PmWiki? Am I right in thinking that it would not be a problem, in practice, in a wiki that was 'locked down' for editing by only a trusted few -- i.e. that one must have edit access to at least one page of the site in order to insert the malicious code?<br>
<br>Thanks, as always, for everything you do!<br><br>Tegan<br><div style="visibility: hidden; display: inline;" id="avg_ls_inline_popup"></div><style type="text/css">#avg_ls_inline_popup { position:absolute; z-index:9999; padding: 0px 0px; margin-left: 0px; margin-top: 0px; width: 240px; overflow: hidden; word-wrap: break-word; color: black; font-size: 10px; text-align: left; line-height: 13px;}</style>