diff options
| author | Frédéric Buclin <LpSolit@gmail.com> | 2011-01-24 19:29:39 +0100 |
|---|---|---|
| committer | Frédéric Buclin <LpSolit@gmail.com> | 2011-01-24 19:29:39 +0100 |
| commit | 9244270a7d1ca49e315a98c24d51bf405bfa2880 (patch) | |
| tree | 46587cdf26360fd54abb79986d11c8b9234e4fe0 /template/en/default/attachment | |
| parent | 38eeecf6362b6dc17718c84a35dbbaea7cc15ccd (diff) | |
| download | bugzilla-9244270a7d1ca49e315a98c24d51bf405bfa2880.tar.gz bugzilla-9244270a7d1ca49e315a98c24d51bf405bfa2880.tar.xz | |
Bug 619588: (CVE-2010-4567) [SECURITY] Safety checks that disallow clicking for javascript: or data: URLs in the URL field can be evaded with prefixed whitespace
and
Bug 628034: (CVE-2011-0048) [SECURITY] For not-logged-in users, the URL field doesn't safeguard against javascript: or data: URLs
r=dkl a=LpSolit
Diffstat (limited to 'template/en/default/attachment')
| -rw-r--r-- | template/en/default/attachment/edit.html.tmpl | 5 |
1 files changed, 1 insertions, 4 deletions
diff --git a/template/en/default/attachment/edit.html.tmpl b/template/en/default/attachment/edit.html.tmpl index 56d2b8a80..eeebcffae 100644 --- a/template/en/default/attachment/edit.html.tmpl +++ b/template/en/default/attachment/edit.html.tmpl @@ -185,10 +185,7 @@ defaultcontent = (attachment.contenttype.match('^text\/')) ? attachment.data.replace('(.*\n|.+)', '>$1') : undef %] - [%# The regexp is stolen from quoteUrls(), see Template.pm %] - [% safe_protocols = constants.SAFE_PROTOCOLS.join('|') %] - [% IF attachment.contenttype == 'text/plain' - && attachment.data.match("^($safe_protocols):" _ '[^\s<>\"]+[\w\/]$') %] + [% IF attachment.contenttype == 'text/plain' AND is_safe_url(attachment.data) %] <p> <a href="[% attachment.data FILTER html %]"> [% IF attachment.datasize < 120 %] |