diff options
| author | Frédéric Buclin <LpSolit@gmail.com> | 2013-10-16 19:15:28 +0200 |
|---|---|---|
| committer | Frédéric Buclin <LpSolit@gmail.com> | 2013-10-16 19:15:28 +0200 |
| commit | 94e43ad559cf6e53b39730d3f4050920ffc69ae3 (patch) | |
| tree | 8204dd8c641d74111dc5db07eb594eaab64f01b9 | |
| parent | 362e68976c570eb0d9bacf07e4b1693012eb4d22 (diff) | |
| download | bugzilla-94e43ad559cf6e53b39730d3f4050920ffc69ae3.tar.gz bugzilla-94e43ad559cf6e53b39730d3f4050920ffc69ae3.tar.xz | |
Bug 924802: (CVE-2013-1742) [SECURITY] (XSS) "id" and "sortkey" are not sanitized when editing flag types if categoryAction-foo is set
r=dkl a=glob
| -rw-r--r-- | template/en/default/admin/flag-type/edit.html.tmpl | 6 | ||||
| -rw-r--r-- | template/en/default/filterexceptions.pl | 2 |
2 files changed, 3 insertions, 5 deletions
diff --git a/template/en/default/admin/flag-type/edit.html.tmpl b/template/en/default/admin/flag-type/edit.html.tmpl index b9ad2a535..2e9771384 100644 --- a/template/en/default/admin/flag-type/edit.html.tmpl +++ b/template/en/default/admin/flag-type/edit.html.tmpl @@ -36,7 +36,7 @@ <form id="flagtype_properties" method="post" action="editflagtypes.cgi"> <input type="hidden" name="action" value="[% action FILTER html %]"> <input type="hidden" name="can_fully_edit" value="[% can_fully_edit FILTER html %]"> - <input type="hidden" name="id" value="[% type.id %]"> + <input type="hidden" name="id" value="[% type.id FILTER html %]"> <input type="hidden" name="token" value="[% token FILTER html %]"> <input type="hidden" name="target_type" value="[% type.target_type FILTER html %]"> <input type="hidden" name="check_clusions" value="[% check_clusions FILTER none %]"> @@ -133,8 +133,8 @@ this type will be sorted when displayed to users in a list; ignore if you don't care what order the types appear in or if you want them to appear in alphabetical order.<br> - <input type="text" name="sortkey" value="[% type.sortkey || 0 %]" size="5" maxlength="5" - [%- ' disabled="disabled"' UNLESS can_fully_edit %]> + <input type="text" name="sortkey" value="[% type.sortkey || 0 FILTER html %]" size="5" + maxlength="5" [% ' disabled="disabled"' UNLESS can_fully_edit %]> </td> </tr> diff --git a/template/en/default/filterexceptions.pl b/template/en/default/filterexceptions.pl index 36b9032dd..239b6828c 100644 --- a/template/en/default/filterexceptions.pl +++ b/template/en/default/filterexceptions.pl @@ -386,8 +386,6 @@ ], 'admin/flag-type/edit.html.tmpl' => [ - 'type.id', - 'type.sortkey || 0', 'selname', ], |