aboutsummaryrefslogtreecommitdiffstats
path: root/template/en/default/email
diff options
context:
space:
mode:
authorManish Goregaokar <manishearth@gmail.com>2014-04-17 18:27:05 +0200
committerFrédéric Buclin <LpSolit@gmail.com>2014-04-17 18:27:05 +0200
commit58b92d3b0245f6565a7ff34e78fce1e9ec56b355 (patch)
tree5b66f0684021f72559184c04a0a4f8294f863582 /template/en/default/email
parent0e390970ba51b14a5dc780be7c6f0d6d7baa67e3 (diff)
downloadbugs-58b92d3b0245f6565a7ff34e78fce1e9ec56b355.tar
bugs-58b92d3b0245f6565a7ff34e78fce1e9ec56b355.tar.gz
bugs-58b92d3b0245f6565a7ff34e78fce1e9ec56b355.tar.bz2
bugs-58b92d3b0245f6565a7ff34e78fce1e9ec56b355.tar.xz
bugs-58b92d3b0245f6565a7ff34e78fce1e9ec56b355.zip
Bug 968576: [SECURITY] Dangerous control characters allowed in Bugzilla text
r=glob a=justdave
Diffstat (limited to 'template/en/default/email')
-rw-r--r--template/en/default/email/bugmail.txt.tmpl2
-rw-r--r--template/en/default/email/flagmail.txt.tmpl2
2 files changed, 2 insertions, 2 deletions
diff --git a/template/en/default/email/bugmail.txt.tmpl b/template/en/default/email/bugmail.txt.tmpl
index 95cda7f10..1f04db7b1 100644
--- a/template/en/default/email/bugmail.txt.tmpl
+++ b/template/en/default/email/bugmail.txt.tmpl
@@ -19,7 +19,7 @@
[%- IF comment.count %]
--- Comment #[% comment.count %] from [% comment.author.identity %] ---
[% END %]
-[%+ comment.body_full({ is_bugmail => 1, wrap => 1 }) %]
+[%+ comment.body_full({ is_bugmail => 1, wrap => 1 }) FILTER strip_control_chars %]
[% END %]
[% IF referenced_bugs.size %]
diff --git a/template/en/default/email/flagmail.txt.tmpl b/template/en/default/email/flagmail.txt.tmpl
index 26b60143d..fe514e103 100644
--- a/template/en/default/email/flagmail.txt.tmpl
+++ b/template/en/default/email/flagmail.txt.tmpl
@@ -69,7 +69,7 @@ Attachment [% attidsummary %]
[%-# .defined is necessary to avoid a taint issue, see bug 509794. %]
[% IF Bugzilla.cgi.param("comment").defined && Bugzilla.cgi.param("comment").length > 0 %]
------- Additional Comments from [% user.identity %]
-[%+ Bugzilla.cgi.param("comment") %]
+[%+ Bugzilla.cgi.param("comment") FILTER strip_control_chars %]
[% END %]
[%- END %]