Reviewed: https://reviews.mahara.org/1457
Committed:
http://gitorious.org/mahara/mahara/commit/47e3906d6791b93b7eaf1d6500828924b10b2bb6
Submitter: Hugh Davenport (h...@catalyst.net.nz)
Branch: master
commit 47e3906d6791b93b7eaf1d6500828924b10b2bb6
Author: Richard Mansfield <richard.mansfi...@catalyst.net.nz>
Date: Mon Jun 11 17:16:37 2012 +1200
Add display_default_name dwoo plugin (bug #1009777)
This just html escapes the output of display_default_name. Existing
calls are modified to avoid double escaping.
Change-Id: I117a748a4d4cdb3313377f3441bbd20567a88fcb
Signed-off-by: Richard Mansfield <richard.mansfi...@catalyst.net.nz>
--
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
https://bugs.launchpad.net/bugs/1009777
Title:
Logged-in user's name unescaped in top right header
Status in Mahara ePortfolio:
Fix Released
Bug description:
Discovered by Emanuel Bronshtein. Present in 1.5
By Changing "Display name" in Content->Profile:
http://localhost/mahara-1.5.1/mahara-1.5.1/htdocs/artefact/internal/
to:
XSS<script>alert(1)</script>
then click "Save profile".
javascript code executed on every request to mahara pages when the user
log-in to the system.
(unfiltered HTML printed near "Settings" in top of the page)
---
I think the display_default_name function should be added as a dwoo
plugin, along the lines of display_name (see
htdocs/lib/dwoo/mahara/plugins/function.display_name.php); other calls
to display_default_name in templates should be modified to avoid
double-escaping.
In the long term perhaps we should reconsider the policy for calls to
php functions in the dwoo templates - I believe the policy can be
changed to disallow calls to arbitrary php functions, or to escape the
output from them, but a change like that would require testing all our
templates, and lots of work for 3rd party plugins & themes.
To manage notifications about this bug go to:
https://bugs.launchpad.net/mahara/+bug/1009777/+subscriptions
_______________________________________________
Mailing list: https://launchpad.net/~mahara-contributors
Post to : mahara-contributors@lists.launchpad.net
Unsubscribe : https://launchpad.net/~mahara-contributors
More help : https://help.launchpad.net/ListHelp
