diff options
| author | Frédéric Buclin <LpSolit@gmail.com> | 2011-01-24 19:29:39 +0100 |
|---|---|---|
| committer | Frédéric Buclin <LpSolit@gmail.com> | 2011-01-24 19:29:39 +0100 |
| commit | 9244270a7d1ca49e315a98c24d51bf405bfa2880 (patch) | |
| tree | 46587cdf26360fd54abb79986d11c8b9234e4fe0 /template/en/default/bug | |
| parent | 38eeecf6362b6dc17718c84a35dbbaea7cc15ccd (diff) | |
| download | bugzilla-9244270a7d1ca49e315a98c24d51bf405bfa2880.tar.gz bugzilla-9244270a7d1ca49e315a98c24d51bf405bfa2880.tar.xz | |
Bug 619588: (CVE-2010-4567) [SECURITY] Safety checks that disallow clicking for javascript: or data: URLs in the URL field can be evaded with prefixed whitespace
and
Bug 628034: (CVE-2011-0048) [SECURITY] For not-logged-in users, the URL field doesn't safeguard against javascript: or data: URLs
r=dkl a=LpSolit
Diffstat (limited to 'template/en/default/bug')
| -rw-r--r-- | template/en/default/bug/edit.html.tmpl | 10 | ||||
| -rw-r--r-- | template/en/default/bug/show-multiple.html.tmpl | 6 |
2 files changed, 7 insertions, 9 deletions
diff --git a/template/en/default/bug/edit.html.tmpl b/template/en/default/bug/edit.html.tmpl index 1ae71b299..0aa5f80af 100644 --- a/template/en/default/bug/edit.html.tmpl +++ b/template/en/default/bug/edit.html.tmpl @@ -555,12 +555,10 @@ [%# Block for URL Keyword and Whiteboard #%] [%############################################################################%] [% BLOCK section_url_keyword_whiteboard %] -[%# *** URL Whiteboard Keywords *** %] <tr> <td class="field_label"> <label for="bug_file_loc" accesskey="u"><b> - [% IF bug.bug_file_loc - AND NOT bug.bug_file_loc.match("^(javascript|data)") %] + [% IF is_safe_url(bug.bug_file_loc) %] <a href="[% bug.bug_file_loc FILTER html %]"><u>U</u>RL</a> [% ELSE %] <u>U</u>RL @@ -570,8 +568,7 @@ <td> [% IF bug.check_can_change_field("bug_file_loc", 0, 1) %] <span id="bz_url_edit_container" class="bz_default_hidden"> - [% IF bug.bug_file_loc - AND NOT bug.bug_file_loc.match("^(javascript|data)") %] + [% IF is_safe_url(bug.bug_file_loc) %] <a href="[% bug.bug_file_loc FILTER html %]" target="_blank" title="[% bug.bug_file_loc FILTER html %]"> [% bug.bug_file_loc FILTER truncate(40) FILTER html %]</a> @@ -582,7 +579,8 @@ [% END %] <span id="bz_url_input_area"> [% url_output = PROCESS input no_td=1 inputname => "bug_file_loc" size => "40" colspan => 2 %] - [% IF NOT bug.check_can_change_field("bug_file_loc", 0, 1) %] + [% IF NOT bug.check_can_change_field("bug_file_loc", 0, 1) + AND is_safe_url(bug.bug_file_loc) %] <a href="[% bug.bug_file_loc FILTER html %]">[% url_output FILTER none %]</a> [% ELSE %] [% url_output FILTER none %] diff --git a/template/en/default/bug/show-multiple.html.tmpl b/template/en/default/bug/show-multiple.html.tmpl index 56f732667..33dde14a3 100644 --- a/template/en/default/bug/show-multiple.html.tmpl +++ b/template/en/default/bug/show-multiple.html.tmpl @@ -163,11 +163,11 @@ <tr> <th>[% field_descs.bug_file_loc FILTER html %]:</th> <td colspan="3"> - [% IF bug.bug_file_loc.match("^(javascript|data)") %] - [% bug.bug_file_loc FILTER html %] - [% ELSE %] + [% IF is_safe_url(bug.bug_file_loc) %] <a href="[% bug.bug_file_loc FILTER html %]"> [% bug.bug_file_loc FILTER html %]</a> + [% ELSE %] + [% bug.bug_file_loc FILTER html %] [% END %] </td> </tr> |