bugphpGroupWare - Bugs: bug #8094, Security issue - HTML tags can be...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #8094: Security issue - HTML tags can be inserted into adressbook fields

Submitter:  Kai Hofmann <powerstat>
Submitted:  Wed 10 Mar 2004 01:31:16 PM UTC
   
 
Category:  addressbook Item Group:  SVN trunk (dev code)
Severity:  6 - Security Priority:  9 - Immediate
Status:  Works For Me Privacy:  Public
Assigned to:  jarg Open/Closed:  Closed
Component Version:  SVN Operating System:  None
Reproducibility:  Every Time Planned Release:  None
Fixed Release: 

Jump to the original submission

Tue 16 Mar 2004 04:52:36 PM UTC, comment #7: 

yes, this works for me, see attached screenshots .

i can close this?

Jonathan Rivera <jarg>
Tue 16 Mar 2004 01:54:38 PM UTC, comment #6: 

jarg: is this fixed?

kai: 10 out of 10 for discression

Dave Hall <skwashd>
Group administrator
Fri 12 Mar 2004 05:43:45 PM UTC, comment #5: 

hehe, this works for me, see attached screenshots

i test with idots and probusiness templates but would work with any.

regards.

Jonathan Rivera <jarg>
Fri 12 Mar 2004 08:07:04 AM UTC, comment #4: 

In the addressbook, someone entered
</table>
as the text for the "Department" field in contacts.

Just </tabel>, without a leading <table>.

That breaks the layout of the page completely, see attached screenshots

bofh42

Dr. Christian Böttger <cboettger>
Thu 11 Mar 2004 06:46:21 PM UTC, comment #3: 

mm, ok, i can't reproduce this.

check, i write

<b>My name</b>

in the first name field, if you go to any other tab, you can see that i show the name and this show

<b>My name</b>

not My name in bold. Now if you save this you can see that in the db the first_name field in phpgw_contact_person have

<b>My name</b>

but always that i show this field in the ui i pass this for htmlencode, so this never can be a security issue.

Now, if you really have

My name in bold

please recheck that you have the last code or tellme what exactly is your test and i try to reproduce this.

thanks

Jonathan Rivera <jarg>
Thu 11 Mar 2004 12:59:31 PM UTC, comment #2: 

The problem has been verified with actual cvs checkout from 2004-03-10 - so the security problem is there!!!

Kai Hofmann <powerstat>
Wed 10 Mar 2004 04:00:57 PM UTC, comment #1: 

ok, this was fixed some time ago, you can see that in my output i use htmlencode for the strings to avoid this problem.

please if you have this problem still check that you have the last code from cvs.

thanks.

Jonathan Rivera <jarg>
Wed 10 Mar 2004 01:31:16 PM UTC, original submission:  

Writing HTML tags into addressbook fields (for example </table>) will corrupt the output!

$GLOBALS['phpgw']->strip_html($data) must be used on the users input before writing it into the database.

Becareful other code injections like javascript(?) and SQL might also be possible!

Kai Hofmann <powerstat>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #1130:  html_tags.png added by jarg (54KiB - image/png - html tags works)
file #1129:  m2n-2.gif added by cboettger (158KiB - image/gif - Screenshot 2)
file #1128:  m2n-1.gif added by cboettger (127KiB - image/gif - Screenshot 1)

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

 

Follow 16 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2004-03-21 jarg Open/ClosedOpen Closed
2004-03-16 jarg StatusNone Works For Me
2004-03-12 jarg Attached File- Added html_tags.png, #1111
2004-03-12 cboettger Attached File- Added m2n-2.gif, #1110
    Carbon-Copy- Added cboettger
2004-03-12 cboettger Carbon-CopyRemoved cboettger --AT-- probusiness --DOT-- de -
2004-03-12 cboettger StatusWorks For Me None
    Attached File- Added m2n-1.gif, #1109
    Carbon-Copy- Added cboettger --AT-- probusiness --DOT-- de
2004-03-11 jarg StatusNone Works For Me
    Assigned toalexbsa jarg
2004-03-11 powerstat StatusFixed None
    Open/ClosedClosed Open
    ReproducibilityNone Every Time
2004-03-10 jarg StatusNone Fixed
    Open/ClosedOpen Closed

Back to the top

Powered by Savane 3.13-02a9.
Corresponding source code