helpSavannah Administration - Support: sr #107282, XSS in account email change form

 
 

sr #107282: XSS in account email change form

Submitted by:  Matt McCutchen <hashproduct>
Submitted on:  Wed 24 Feb 2010 11:39:20 PM UTC  
Votes:  50  
 
Category:  Savannah website Priority:  5 - Normal
Severity:  6 - Security Status:  Done
Assigned to:  Sylvain Beucler <Beuc> Operating System:  None
Open/Closed:  Closed

Add a New Comment (Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 11 Jun 2010 01:05:31 AM UTC, comment #5: 

Confirmed.  The link in comment #0 no longer produces XSS.  Thanks.

Matt McCutchen <hashproduct>
Wed 09 Jun 2010 06:27:41 PM UTC, comment #4: 
Sylvain Beucler <Beuc>In charge of this item.
Wed 09 Jun 2010 02:06:27 PM UTC, comment #3: 

I've attached a patch. I didn't test it because I don't have a test environment for it here, but it should at least give you an idea of how to fix it.

(file #20709)

Jann Horn <tajh>
Sat 08 May 2010 06:39:40 PM UTC, comment #2: 

Hi,

We would gladly welcome a patch.
Check the "source code" link at the bottom to locate the source code.

Sylvain Beucler <Beuc>In charge of this item.
Fri 07 May 2010 11:20:42 PM UTC, comment #1: 

Admins, what do I have to do to get you to take this seriously?  You're currently trusting every site you visit while logged into Savannah not to take over your session and wreak havoc on the site.  Should I put up an attack page that publicly displays the session cookies of its victims?

Matt McCutchen <hashproduct>
Wed 24 Feb 2010 11:39:20 PM UTC, original submission:  
Matt McCutchen <hashproduct>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #20709:  change.php.patch added by tajh (117B - text/x-patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by tajh (Updated the item)
  • -email is unavailable- added by tajh (Voted in favor of this item)
  • -email is unavailable- added by Beuc (Posted a comment)
  • -email is unavailable- added by hashproduct (Voted in favor of this item)
  • -email is unavailable- added by hashproduct (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 50 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-06-09 Beuc StatusIn Progress => Done
        Assigned toNone => Beuc
        Open/ClosedOpen => Closed
    2010-06-09 tajh Attached File- => Added change.php.patch, #20709
        Carbon-Copy- => Added tajh
    2010-05-08 Beuc StatusNone => In Progress
    2010-02-24 hashproduct Carbon-Copy- => Added hashproduct

    Back to the top


    Powered by Savane 3.7