aboutsummaryrefslogtreecommitdiffstats
path: root/template/en
diff options
context:
space:
mode:
authorFrédéric Buclin <LpSolit@gmail.com>2013-10-16 19:15:28 +0200
committerFrédéric Buclin <LpSolit@gmail.com>2013-10-16 19:15:28 +0200
commit94e43ad559cf6e53b39730d3f4050920ffc69ae3 (patch)
tree8204dd8c641d74111dc5db07eb594eaab64f01b9 /template/en
parent362e68976c570eb0d9bacf07e4b1693012eb4d22 (diff)
downloadbugs-94e43ad559cf6e53b39730d3f4050920ffc69ae3.tar
bugs-94e43ad559cf6e53b39730d3f4050920ffc69ae3.tar.gz
bugs-94e43ad559cf6e53b39730d3f4050920ffc69ae3.tar.bz2
bugs-94e43ad559cf6e53b39730d3f4050920ffc69ae3.tar.xz
bugs-94e43ad559cf6e53b39730d3f4050920ffc69ae3.zip
Bug 924802: (CVE-2013-1742) [SECURITY] (XSS) "id" and "sortkey" are not sanitized when editing flag types if categoryAction-foo is set
r=dkl a=glob
Diffstat (limited to 'template/en')
-rw-r--r--template/en/default/admin/flag-type/edit.html.tmpl6
-rw-r--r--template/en/default/filterexceptions.pl2
2 files changed, 3 insertions, 5 deletions
diff --git a/template/en/default/admin/flag-type/edit.html.tmpl b/template/en/default/admin/flag-type/edit.html.tmpl
index b9ad2a535..2e9771384 100644
--- a/template/en/default/admin/flag-type/edit.html.tmpl
+++ b/template/en/default/admin/flag-type/edit.html.tmpl
@@ -36,7 +36,7 @@
<form id="flagtype_properties" method="post" action="editflagtypes.cgi">
<input type="hidden" name="action" value="[% action FILTER html %]">
<input type="hidden" name="can_fully_edit" value="[% can_fully_edit FILTER html %]">
- <input type="hidden" name="id" value="[% type.id %]">
+ <input type="hidden" name="id" value="[% type.id FILTER html %]">
<input type="hidden" name="token" value="[% token FILTER html %]">
<input type="hidden" name="target_type" value="[% type.target_type FILTER html %]">
<input type="hidden" name="check_clusions" value="[% check_clusions FILTER none %]">
@@ -133,8 +133,8 @@
this type will be sorted when displayed to users in a list; ignore if you
don't care what order the types appear in or if you want them to appear
in alphabetical order.<br>
- <input type="text" name="sortkey" value="[% type.sortkey || 0 %]" size="5" maxlength="5"
- [%- ' disabled="disabled"' UNLESS can_fully_edit %]>
+ <input type="text" name="sortkey" value="[% type.sortkey || 0 FILTER html %]" size="5"
+ maxlength="5" [% ' disabled="disabled"' UNLESS can_fully_edit %]>
</td>
</tr>
diff --git a/template/en/default/filterexceptions.pl b/template/en/default/filterexceptions.pl
index 36b9032dd..239b6828c 100644
--- a/template/en/default/filterexceptions.pl
+++ b/template/en/default/filterexceptions.pl
@@ -386,8 +386,6 @@
],
'admin/flag-type/edit.html.tmpl' => [
- 'type.id',
- 'type.sortkey || 0',
'selname',
],