diff -Nru dokuwiki-0.0.20080505/debian/changelog dokuwiki-0.0.20080505/debian/changelog
--- dokuwiki-0.0.20080505/debian/changelog	2011-06-26 13:26:03.000000000 +0200
+++ dokuwiki-0.0.20080505/debian/changelog	2011-06-26 13:26:03.000000000 +0200
@@ -1,3 +1,10 @@
+dokuwiki (0.0.20080505-4+lenny3) oldstable; urgency=low
+
+  * debian/patches/rss_security.diff: Backport an upstream security fix for an
+    XSS vulnerability in the RSS embedding mechanism.
+
+ -- Tanguy Ortolo <tanguy+debian@ortolo.eu>  Sun, 26 Jun 2011 13:23:05 +0200
+
 dokuwiki (0.0.20080505-4+lenny2) oldstable; urgency=low
 
   * debian/patches/xmlrpc_security.diff: Backport an upstream security fix
diff -Nru dokuwiki-0.0.20080505/debian/patches/rss_security.diff dokuwiki-0.0.20080505/debian/patches/rss_security.diff
--- dokuwiki-0.0.20080505/debian/patches/rss_security.diff	1970-01-01 01:00:00.000000000 +0100
+++ dokuwiki-0.0.20080505/debian/patches/rss_security.diff	2011-06-26 13:26:03.000000000 +0200
@@ -0,0 +1,38 @@
+Author: Andreas Gohr <andi@splitbrain.org>
+Author: Tanguy Ortolo <tanguy+debian@ortolo.eu>
+Origin: upstream, https://github.com/splitbrain/dokuwiki/commit/8dd5c1d6612a6c7f217da041703183200405fa90
+Last-Update: 2011-06-26
+Description: Fix a cross-site scripting vulnerability in the RSS embedding mechanism
+    .
+    This fixes a problem where JavaScript could be introduced through
+    specially crafted RSS feeds.
+    .
+    This also fixes a problem where JavaScript links could be introduced by
+    specifying it as an RSS URL: the resulting error message displays a
+    link to the broken feed URL. This patch makes sure there's no working
+    link for unknown protocols.
+
+Index: dokuwiki-0.0.20080505/inc/parser/xhtml.php
+===================================================================
+--- dokuwiki-0.0.20080505.orig/inc/parser/xhtml.php	2008-05-05 19:10:08.000000000 +0200
++++ dokuwiki-0.0.20080505/inc/parser/xhtml.php	2011-06-26 13:21:21.743609982 +0200
+@@ -543,6 +543,19 @@
+ 
+         $name = $this->_getLinkTitle($name, $url, $isImage);
+ 
++        // url might be an attack vector, only allow registered protocols
++        if(is_null($this->schemes)) $this->schemes = getSchemes();
++        list($scheme) = explode('://',$url);
++        $scheme = strtolower($scheme);
++        if(!in_array($scheme,$this->schemes)) $url = '';
++
++        // is there still an URL?
++        if(!$url){
++            $this->doc .= $name;
++            return;
++        }
++
++        // set class
+         if ( !$isImage ) {
+             $class='urlextern';
+         } else {
diff -Nru dokuwiki-0.0.20080505/debian/patches/series dokuwiki-0.0.20080505/debian/patches/series
--- dokuwiki-0.0.20080505/debian/patches/series	2011-06-26 13:26:03.000000000 +0200
+++ dokuwiki-0.0.20080505/debian/patches/series	2011-06-26 13:26:03.000000000 +0200
@@ -5,3 +5,4 @@
 debianize.diff
 security.diff
 xmlrpc_security.diff
+rss_security.diff