diff options
| author | Dylan William Hardison <dylan@hardison.net> | 2018-03-20 15:06:20 +0100 |
|---|---|---|
| committer | Dylan William Hardison <dylan@hardison.net> | 2018-03-20 15:06:20 +0100 |
| commit | 40023c4a9f7d949f623b3b6fa90c9cbf5dfc2351 (patch) | |
| tree | 8b712354b3cc527db6c498d11a50cdbbc2a42837 | |
| parent | 4cd99a91ff6a92a5e10449463b12a312060d01ba (diff) | |
| download | bugzilla-40023c4a9f7d949f623b3b6fa90c9cbf5dfc2351.tar.gz bugzilla-40023c4a9f7d949f623b3b6fa90c9cbf5dfc2351.tar.xz | |
Bug 1444008 - Form action injection in Bugzilla /user_profile (leads to XSS/single-factor credential leakage)
| -rw-r--r-- | .htaccess | 6 | ||||
| -rw-r--r-- | extensions/UserProfile/template/en/default/pages/user_profile.html.tmpl | 2 | ||||
| -rw-r--r-- | template/en/default/account/auth/login.html.tmpl | 2 |
3 files changed, 5 insertions, 5 deletions
@@ -37,9 +37,9 @@ RewriteRule ^new[-_]bug$ new_bug.cgi [L,QSA] RewriteRule ^template_cache/ - [F,L,NC] RewriteRule ^template_cache.deleteme/ - [F,L,NC] -RewriteRule ^review(.*) page.cgi?id=splinter.html$1 [QSA] -RewriteRule ^user_?profile(.*) page.cgi?id=user_profile.html$1 [QSA] -RewriteRule ^request_defer(.*) page.cgi?id=request_defer.html$1 [QSA] +RewriteRule ^review$ page.cgi?id=splinter.html$1 [QSA] +RewriteRule ^user_?profile$ page.cgi?id=user_profile.html$1 [QSA] +RewriteRule ^request_defer$ page.cgi?id=request_defer.html$1 [QSA] RewriteRule ^favicon\.ico$ extensions/BMO/web/images/favicon.ico RewriteRule ^form[\.:]itrequest$ enter_bug.cgi?product=Infrastructure+\%26+Operations&format=itrequest [QSA] RewriteRule ^form[\.:](mozlist|poweredby|presentation|trademark|recoverykey)$ enter_bug.cgi?product=mozilla.org&format=$1 [QSA] diff --git a/extensions/UserProfile/template/en/default/pages/user_profile.html.tmpl b/extensions/UserProfile/template/en/default/pages/user_profile.html.tmpl index 27cb825ed..fd72091dc 100644 --- a/extensions/UserProfile/template/en/default/pages/user_profile.html.tmpl +++ b/extensions/UserProfile/template/en/default/pages/user_profile.html.tmpl @@ -27,7 +27,7 @@ <td> </td> <th>Search</th> <td colspan="2"> - <form action="user_profile"> + <form action="[% urlbase %]user_profile"> [% INCLUDE global/userselect.html.tmpl id => "login" name => "login" diff --git a/template/en/default/account/auth/login.html.tmpl b/template/en/default/account/auth/login.html.tmpl index 160fad43b..c11a6afc1 100644 --- a/template/en/default/account/auth/login.html.tmpl +++ b/template/en/default/account/auth/login.html.tmpl @@ -42,7 +42,7 @@ </p> <div id="login" class="login-form"> - <form name="login" action="[% target FILTER html %]" method="POST" + <form name="login" action="[% urlbase %][% target FILTER uri FILTER html %]" method="POST" [%- IF Bugzilla.cgi.param("data") %] enctype="multipart/form-data"[% END %]> <div class="field-login"> <label for="Bugzilla_login">Email Address:</label> |