diff options
| author | Frédéric Buclin <LpSolit@gmail.com> | 2013-10-16 19:15:28 +0200 |
|---|---|---|
| committer | Frédéric Buclin <LpSolit@gmail.com> | 2013-10-16 19:15:28 +0200 |
| commit | 94e43ad559cf6e53b39730d3f4050920ffc69ae3 (patch) | |
| tree | 8204dd8c641d74111dc5db07eb594eaab64f01b9 /template/en/default/admin | |
| parent | 362e68976c570eb0d9bacf07e4b1693012eb4d22 (diff) | |
| download | bugs-94e43ad559cf6e53b39730d3f4050920ffc69ae3.tar bugs-94e43ad559cf6e53b39730d3f4050920ffc69ae3.tar.gz bugs-94e43ad559cf6e53b39730d3f4050920ffc69ae3.tar.bz2 bugs-94e43ad559cf6e53b39730d3f4050920ffc69ae3.tar.xz bugs-94e43ad559cf6e53b39730d3f4050920ffc69ae3.zip | |
Bug 924802: (CVE-2013-1742) [SECURITY] (XSS) "id" and "sortkey" are not sanitized when editing flag types if categoryAction-foo is set
r=dkl a=glob
Diffstat (limited to 'template/en/default/admin')
| -rw-r--r-- | template/en/default/admin/flag-type/edit.html.tmpl | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/template/en/default/admin/flag-type/edit.html.tmpl b/template/en/default/admin/flag-type/edit.html.tmpl index b9ad2a535..2e9771384 100644 --- a/template/en/default/admin/flag-type/edit.html.tmpl +++ b/template/en/default/admin/flag-type/edit.html.tmpl @@ -36,7 +36,7 @@ <form id="flagtype_properties" method="post" action="editflagtypes.cgi"> <input type="hidden" name="action" value="[% action FILTER html %]"> <input type="hidden" name="can_fully_edit" value="[% can_fully_edit FILTER html %]"> - <input type="hidden" name="id" value="[% type.id %]"> + <input type="hidden" name="id" value="[% type.id FILTER html %]"> <input type="hidden" name="token" value="[% token FILTER html %]"> <input type="hidden" name="target_type" value="[% type.target_type FILTER html %]"> <input type="hidden" name="check_clusions" value="[% check_clusions FILTER none %]"> @@ -133,8 +133,8 @@ this type will be sorted when displayed to users in a list; ignore if you don't care what order the types appear in or if you want them to appear in alphabetical order.<br> - <input type="text" name="sortkey" value="[% type.sortkey || 0 %]" size="5" maxlength="5" - [%- ' disabled="disabled"' UNLESS can_fully_edit %]> + <input type="text" name="sortkey" value="[% type.sortkey || 0 FILTER html %]" size="5" + maxlength="5" [% ' disabled="disabled"' UNLESS can_fully_edit %]> </td> </tr> |