phpGroupWare - Bugs: bug #8094, Security issue - HTML tags can be...
You are not allowed to post comments on this tracker with your current authentication level.
bug #8094: Security issue - HTML tags can be inserted into adressbook fields
Submitter: | Kai Hofmann <powerstat> | ||
Submitted: | Wed 10 Mar 2004 01:31:16 PM UTC | ||
Category: | addressbook | Item Group: | SVN trunk (dev code) |
Severity: | 6 - Security | Priority: | 9 - Immediate |
Status: | Works For Me | Privacy: | Public |
Assigned to: | jarg | Open/Closed: | Closed |
Component Version: | SVN | Operating System: | None |
Reproducibility: | Every Time | Planned Release: | None |
Fixed Release: |
Jump to the original submission
Tue 16 Mar 2004 04:52:36 PM UTC, comment #7: |
Jonathan Rivera <jarg> |
Tue 16 Mar 2004 01:54:38 PM UTC, comment #6: jarg: is this fixed?
|
Dave Hall <skwashd> |
Fri 12 Mar 2004 05:43:45 PM UTC, comment #5: hehe, this works for me, see attached screenshots
|
Jonathan Rivera <jarg> |
Fri 12 Mar 2004 08:07:04 AM UTC, comment #4: In the addressbook, someone entered
|
Dr. Christian Böttger <cboettger> |
Thu 11 Mar 2004 06:46:21 PM UTC, comment #3: mm, ok, i can't reproduce this.
|
Jonathan Rivera <jarg> |
Thu 11 Mar 2004 12:59:31 PM UTC, comment #2: The problem has been verified with actual cvs checkout from 2004-03-10 - so the security problem is there!!!
|
Kai Hofmann <powerstat> |
Wed 10 Mar 2004 04:00:57 PM UTC, comment #1: ok, this was fixed some time ago, you can see that in my output i use htmlencode for the strings to avoid this problem.
|
Jonathan Rivera <jarg> |
Wed 10 Mar 2004 01:31:16 PM UTC, original submission:
Writing HTML tags into addressbook fields (for example </table>) will corrupt the output!
|
Kai Hofmann <powerstat> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 16 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2004-03-21 | jarg | Open/Closed | Open | Closed | |
2004-03-16 | jarg | Status | None | Works For Me | |
2004-03-12 | jarg | Attached File | - | Added html_tags.png, #1111 | |
2004-03-12 | cboettger | Attached File | - | Added m2n-2.gif, #1110 | |
Carbon-Copy | - | Added cboettger | |||
2004-03-12 | cboettger | Carbon-Copy | Removed cboettger --AT-- probusiness --DOT-- de | - | |
2004-03-12 | cboettger | Status | Works For Me | None | |
Attached File | - | Added m2n-1.gif, #1109 | |||
Carbon-Copy | - | Added cboettger --AT-- probusiness --DOT-- de | |||
2004-03-11 | jarg | Status | None | Works For Me | |
Assigned to | alexbsa | jarg | |||
2004-03-11 | powerstat | Status | Fixed | None | |
Open/Closed | Closed | Open | |||
Reproducibility | None | Every Time | |||
2004-03-10 | jarg | Status | None | Fixed | |
Open/Closed | Open | Closed |
Powered by Savane 3.13-02a9.
Corresponding source code
yes, this works for me, see attached screenshots .
i can close this?