Security Advisories (5)
CVE-2021-23562 (2021-12-03)

This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file.

CVE-2021-41182 (2021-10-26)

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.

CVE-2021-41183 (2021-10-26)

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.

CVE-2021-41184 (2021-10-26)

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.

CVE-2016-4566 (2016-05-22)

Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via a Same-Origin Method Execution (SOME) attack.

Changes for version 0.991_002 - 2017-08-03 (TRIAL RELEASE)

  • Minor: Added a new set of management screens for managing users in the application. Requires new special permissions and no menus to get to these screens are yet provided. VERY ALPHA.
  • Minor: Internal refactored to allow app-managed users and repository configuration.
  • Minor: A tiny bit more testing infrastructure.

Changes for version 0.991_001 - 2017-07-22 (TRIAL RELEASE)

  • Bugfix: Fixing various bugs with yukki-setup. Mostly, removed File::Copy::Recursive because it was flaking out in some cases.
  • Minor: Improved modern testing infrastructure.

Changes for version 0.990_002 - 2017-07-20 (TRIAL RELEASE)

  • Bugfix: Fix yukki-git-init, which was broke since a long time ago due to the create() method being deprecated in Git::Repository.

Changes for version 0.990_001 - 2017-07-20 (TRIAL RELEASE)

  • Minor: Using the correct number of digits in the V#.

Changes for version 0.99_01 - 2017-07-19 (TRIAL RELEASE)

  • Major: This is a significant update and refactor of internals, but doesn't really change anything regarding actual functionality. Mostly, it was a little broken due to a lack of maintenance.
  • Major: Now requires Perl v5.24.
  • Major: Templates are now rendered using Template::Pure rather than Template::Sematic. This is a better maintained templating system that adds an additional abstraction layer, which is very helpful. Templates are unchanged, though.
  • Major: Completely refactored to use Moo and Types::Tiny instead of Moose and Path::Tiny instead of Path::Class. I'm trying to get rid of all the silly extra CPAN requirements it had before, but didn't really need.
  • Major: Updated to jQuery 3.2.1, jQuery UI 1.12.1, and plupload 2.3.1.
  • Minor: Better UTF-8 support.
  • Minor: Removed "Fork on Github" banners.
  • Minor: Some testing infrastructure updated to explicitly use Test2::V0

Documentation

add users to a Yukki installation
Initialize a git repository for use with Yukki
set the password for a user
constructs the boilerplate needed to start a Yukki site
installaction instructions

Modules

Yet Uh-nother wiki
Yukki's exception class
Base class for model objects
the model for loading and saving files in the wiki
a sub-class of the File model for handling previews
model for accessing objects in a git repository
model for accessing the git repositories
lookup users
the role Yukki app-classes implement
Provides a mechanism for YAML-izing objects
provides structure and validation to settings in yukki.conf
settings describing privileges
settings describing a wiki repository
Utiltiies that help make manipulating the DOM easier
Utilities to help make everything happy UTF-8
standard types for use in Yukki
Encapsulates Yukki users
the Yukki web server
request-response context descriptor
Base class for Yukki::Web controllers
controller for administering your wiki
Controller for uploading, downloading, and viewing attachments
shows the login page and handles login
controller for viewing and editing pages
Simple controller for handling internal redirects
base class for Yukki plugins
plugin for attachments
interface for quick format helpers
interface for HTML formatters
add spreadsheet functionality to wiki pages
add syntax highlighting to wiki pages
plugin for custom page viewers
format text/yukki files using markdown, etc.
Yukki request descriptor
the response to the client
send requests to the correct controllers, yo
Adds ACLs to routes
Matching with access controls
provides structure and validation to web settings in yukki.conf
base class for Yukki::Web views
display user admin screens
View for attachment forms
show a login form
render HTML for viewing and editing wiki pages

Provides

in lib/Yukki/Error.pm
in lib/Yukki/Settings.pm