bugphpGroupWare - Bugs: bug #8094, Security issue - HTML tags can be...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #8094: Security issue - HTML tags can be inserted into adressbook fields

Submitted by:  Kai Hofmann <powerstat>
Submitted on:  Wed 10 Mar 2004 01:31:16 PM UTC  
 
Item Group: SVN trunk (dev code)Category: addressbook
Severity: 6 - SecurityPriority: 9 - Immediate
Status: Works For MePrivacy: Public
Assigned to: Jonathan Rivera <jarg>Open/Closed: Closed
Component Version: SVNOperating System: None
Reproducibility: Every TimePlanned Release: None
Fixed Release: 

(Jump to the original submission Jump to the original submission)

Tue 16 Mar 2004 04:52:36 PM UTC, comment #7:

yes, this works for me, see attached screenshots .

i can close this?

Jonathan Rivera <jarg>In charge of this item.
Tue 16 Mar 2004 01:54:38 PM UTC, comment #6:

jarg: is this fixed?

kai: 10 out of 10 for discression

Dave Hall <skwashd>
Project Administrator
Fri 12 Mar 2004 05:43:45 PM UTC, comment #5:

hehe, this works for me, see attached screenshots

i test with idots and probusiness templates but would work with any.

regards.

Jonathan Rivera <jarg>In charge of this item.
Fri 12 Mar 2004 08:07:04 AM UTC, comment #4:

In the addressbook, someone entered
</table>
as the text for the "Department" field in contacts.

Just </tabel>, without a leading <table>.

That breaks the layout of the page completely, see attached screenshots

bofh42

Dr. Christian Böttger <cboettger>
Thu 11 Mar 2004 06:46:21 PM UTC, comment #3:

mm, ok, i can't reproduce this.

check, i write

<b>My name</b>

in the first name field, if you go to any other tab, you can see that i show the name and this show

<b>My name</b>

not My name in bold. Now if you save this you can see that in the db the first_name field in phpgw_contact_person have

<b>My name</b>

but always that i show this field in the ui i pass this for htmlencode, so this never can be a security issue.

Now, if you really have

My name in bold

please recheck that you have the last code or tellme what exactly is your test and i try to reproduce this.

thanks

Jonathan Rivera <jarg>In charge of this item.
Thu 11 Mar 2004 12:59:31 PM UTC, comment #2:

The problem has been verified with actual cvs checkout from 2004-03-10 - so the security problem is there!!!

Kai Hofmann <powerstat>
Wed 10 Mar 2004 04:00:57 PM UTC, comment #1:

ok, this was fixed some time ago, you can see that in my output i use htmlencode for the strings to avoid this problem.

please if you have this problem still check that you have the last code from cvs.

thanks.

Jonathan Rivera <jarg>In charge of this item.
Wed 10 Mar 2004 01:31:16 PM UTC, original submission:

Writing HTML tags into addressbook fields (for example </table>) will corrupt the output!

$GLOBALS['phpgw']->strip_html($data) must be used on the users input before writing it into the database.

Becareful other code injections like javascript(?) and SQL might also be possible!

Kai Hofmann <powerstat>

 

Attached Files
file #1130:  html_tags.png added by jarg (54KiB - image/png - html tags works)
file #1129:  m2n-2.gif added by cboettger (158KiB - image/gif - Screenshot 2)
file #1128:  m2n-1.gif added by cboettger (127KiB - image/gif - Screenshot 1)

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 16 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Sun 21 Mar 2004 12:44:20 AM UTCjargOpen/ClosedOpen=>Closed
Tue 16 Mar 2004 04:52:36 PM UTCjargStatusNone=>Works For Me
Fri 12 Mar 2004 05:43:45 PM UTCjargAttached File-=>Added html_tags.png, #1111
Fri 12 Mar 2004 08:13:19 AM UTCcboettgerAttached File-=>Added m2n-2.gif, #1110
  Carbon-Copy-=>Added cboettger
Fri 12 Mar 2004 08:12:01 AM UTCcboettgerCarbon-CopyRemoved cboettger --AT-- probusiness --DOT-- de=>-
Fri 12 Mar 2004 08:07:04 AM UTCcboettgerStatusWorks For Me=>None
  Attached File-=>Added m2n-1.gif, #1109
  Carbon-Copy-=>Added cboettger --AT-- probusiness --DOT-- de
Thu 11 Mar 2004 06:46:21 PM UTCjargStatusNone=>Works For Me
  Assigned toalexbsa=>jarg
Thu 11 Mar 2004 12:59:31 PM UTCpowerstatStatusFixed=>None
  Open/ClosedClosed=>Open
  ReproducibilityNone=>Every Time
Wed 10 Mar 2004 04:00:57 PM UTCjargStatusNone=>Fixed
  Open/ClosedOpen=>Closed

Back to the top


Powered by Savane 3.1-cleanup1