security fix for CVE-2017-5934, XSS in GUI editor related code

Thanks to Nitin Venkatesh for discovering and reporting this!

Author: ThomasWaldmann

MoinMoin/action/fckdialog.py

@@ -203,6 +203,7 @@ def page_list(request):
 def link_dialog(request):
     # list of wiki pages
     name = request.values.get("pagename", "")
+    name_escaped = wikiutil.escape(name)
     if name:
         from MoinMoin import search
         # XXX error handling!
@@ -299,7 +300,7 @@ def link_dialog(request):
         <tr>
          <td>
           <span fckLang="PageDlgName">Page Name</span><br>
-          <input id="txtPagename" name="pagename" size="30" value="%(name)s">
+          <input id="txtPagename" name="pagename" size="30" value="%(name_escaped)s">
          </td>
          <td valign="bottom">
            <input id=btnSearchpage type="submit" value="Search">

docs/CHANGES

@@ -23,6 +23,7 @@ Version 1.9.10 aka "the end of spam release" (not released yet)
         should be aware of beforehands.
 
   Fixes:
+  * security fix for CVE-2017-5934, XSS in GUI editor related code
   * fix wrong digestmod of hmac.new calls (incorporate 1.9.9 patch)
   * fix broken table attribute processing (wikiutil.escape)
   * fix AttributeError in multifile action