From: Thomas Waldmann <tw@waldmann-edv.de>
Date: Sat, 8 Sep 2018 22:59:08 +0200
Subject: security fix for CVE-2017-5934, XSS in GUI editor related code
Origin: https://github.com/moinwiki/moin-1.9/commit/70955a8eae091cc88fd9a6e510177e70289ec024
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-5934
Bug-Debian: https://bugs.debian.org/910776

Thanks to Nitin Venkatesh for discovering and reporting this!
---

diff --git a/MoinMoin/action/fckdialog.py b/MoinMoin/action/fckdialog.py
index b86a6a860f7b..e078b7c3ba72 100644
--- a/MoinMoin/action/fckdialog.py
+++ b/MoinMoin/action/fckdialog.py
@@ -203,6 +203,7 @@ def page_list(request):
 def link_dialog(request):
     # list of wiki pages
     name = request.values.get("pagename", "")
+    name_escaped = wikiutil.escape(name)
     if name:
         from MoinMoin import search
         # XXX error handling!
@@ -299,7 +300,7 @@ def link_dialog(request):
         <tr>
          <td>
           <span fckLang="PageDlgName">Page Name</span><br>
-          <input id="txtPagename" name="pagename" size="30" value="%(name)s">
+          <input id="txtPagename" name="pagename" size="30" value="%(name_escaped)s">
          </td>
          <td valign="bottom">
            <input id=btnSearchpage type="submit" value="Search">
-- 
2.11.0

