From c738859a411c63f64fa931a5275111aeb9d90fd8 Mon Sep 17 00:00:00 2001 From: "lpsolit%gmail.com" <> Date: Tue, 21 Feb 2006 08:05:56 +0000 Subject: [SECURITY] Bug 313441: Query RSS should HTML-escape summary in - Patch by Phil Ringnalda <philringnalda@gmail.com> r=myk a=justdave I forgot to specify the bug number in my previous checkin. That was bug 312498. --- Bugzilla/Constants.pm | 2 +- buglist.cgi | 17 +++-- template/en/default/global/header.html.tmpl | 10 +-- template/en/default/list/list.atom.tmpl | 88 ++++++++++++++++++++++++++ template/en/default/list/list.html.tmpl | 14 ++--- template/en/default/list/list.rss.tmpl | 97 ----------------------------- 6 files changed, 112 insertions(+), 116 deletions(-) create mode 100644 template/en/default/list/list.atom.tmpl delete mode 100644 template/en/default/list/list.rss.tmpl diff --git a/Bugzilla/Constants.pm b/Bugzilla/Constants.pm index 09717486e..c00518732 100644 --- a/Bugzilla/Constants.pm +++ b/Bugzilla/Constants.pm @@ -148,7 +148,7 @@ use constant contenttypes => { "html"=> "text/html" , "rdf" => "application/rdf+xml" , - "rss" => "application/rss+xml" , + "atom"=> "application/atom+xml" , "xml" => "application/xml" , "js" => "application/x-javascript" , "csv" => "text/plain" , diff --git a/buglist.cgi b/buglist.cgi index 2ff808451..ba105eab8 100755 --- a/buglist.cgi +++ b/buglist.cgi @@ -103,6 +103,11 @@ if (defined $cgi->param('format') && $cgi->param('format') eq "rdf" $cgi->delete('format'); } +# Treat requests for ctype=rss as requests for ctype=atom +if (defined $cgi->param('ctype') && $cgi->param('ctype') eq "rss") { + $cgi->param('ctype', "atom"); +} + # The js ctype presents a security risk; a malicious site could use it # to gather information about secure bugs. So, we only allow public bugs to be # retrieved with this format. @@ -683,12 +688,12 @@ if ($format->{'extension'} eq 'ics') { push(@selectcolumns, "opendate") if !grep($_ eq 'opendate', @selectcolumns); } -if ($format->{'extension'} eq 'rss') { - # The title of the RSS feed will be the same one as for the bug list. +if ($format->{'extension'} eq 'atom') { + # The title of the Atom feed will be the same one as for the bug list. $vars->{'title'} = $cgi->param('title'); - # This is the list of fields that are needed by the rss filter. - my @required_rss_columns = ( + # This is the list of fields that are needed by the Atom filter. + my @required_atom_columns = ( 'short_desc', 'opendate', 'changeddate', @@ -699,7 +704,7 @@ if ($format->{'extension'} eq 'rss') { 'bug_status' ); - foreach my $required (@required_rss_columns) { + foreach my $required (@required_atom_columns) { push(@selectcolumns, $required) if !grep($_ eq $required,@selectcolumns); } } @@ -934,7 +939,7 @@ while (my @row = $buglist_sth->fetchrow_array()) { s/^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})$/$1-$2-$3 $4:$5:$6/; # Put in the change date as a time, so that the template date plugin - # can format the date in any way needed by the template. ICS and RSS + # can format the date in any way needed by the template. ICS and Atom # have specific, and different, date and time formatting. $bug->{'changedtime'} = str2time($bug->{'changeddate'}); $bug->{'changeddate'} = DiffDate($bug->{'changeddate'}); diff --git a/template/en/default/global/header.html.tmpl b/template/en/default/global/header.html.tmpl index 90c3659fe..959bf5a99 100644 --- a/template/en/default/global/header.html.tmpl +++ b/template/en/default/global/header.html.tmpl @@ -35,7 +35,7 @@ # style: string. CSS style. # style_urls: list. List of URLs to CSS style sheets. # message: string. A message to display to the user. May contain HTML. - # rsslink: rss link url, May contain HTML + # atomlink: Atom link url, May contain HTML #%] [% IF message %] @@ -100,11 +100,11 @@ [% END %] [% END %] - [%# this puts the live bookmark up on firefox for the RSS feed %] - [% IF rsslink %] + [%# this puts the live bookmark up on firefox for the Atom feed %] + [% IF atomlink %] <link rel="alternate" - type="application/rss+xml" title="RSS 1.0" - href="[% rsslink FILTER html %]" /> + type="application/atom+xml" title="Atom feed" + href="[% atomlink FILTER html %]" /> [% END %] </head> diff --git a/template/en/default/list/list.atom.tmpl b/template/en/default/list/list.atom.tmpl new file mode 100644 index 000000000..367f2858f --- /dev/null +++ b/template/en/default/list/list.atom.tmpl @@ -0,0 +1,88 @@ +[%# 1.0@bugzilla.org %] +[%# The contents of this file are subject to the Mozilla Public + # License Version 1.1 (the "License"); you may not use this file + # except in compliance with the License. You may obtain a copy of + # the License at http://www.mozilla.org/MPL/ + # + # Software distributed under the License is distributed on an "AS + # IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or + # implied. See the License for the specific language governing + # rights and limitations under the License. + # + # The Original Code is the Bugzilla Bug Tracking System. + # + # The Initial Developer of the Original Code is Netscape Communications + # Corporation. Portions created by Netscape are + # Copyright (C) 1998 Netscape Communications Corporation. All + # Rights Reserved. + # + # Contributor(s): Walter Hoehn <wassa@columbia.edu> + # John Belmonte <john@neggie.net> + # Jason Remillard <jremillardshop@letterboxes.org> + # Phil Ringnalda <bugzilla@philringnalda.com> + # + # This is a template for generating an Atom representation of a buglist. + #%] + +[% PROCESS global/variables.none.tmpl %] +[% USE date %] + +[% DEFAULT title = "$terms.Bugzilla $terms.Bugs" %] + +<?xml version="1.0"[% IF Param('utf8') %] encoding="UTF-8"[% END %]?> +<feed xmlns="http://www.w3.org/2005/Atom"> + <title>[% title FILTER xml %] + + + [% date.format(format=>"%Y-%m-%dT%H:%M:%SZ", + time=>bugs.nsort('changedtime').last.changedtime, + gmt=>1) FILTER xml %] + [% Param('urlbase') %]buglist.cgi?[% urlquerypart FILTER xml %] + + [% FOREACH bug = bugs %] + + [% "@" IF bug.secure_mode %][[% terms.Bug %] [%+ bug.bug_id FILTER xml %]] [% bug.short_desc FILTER xml %] + + [% Param('urlbase') FILTER xml %]show_bug.cgi?id=[% bug.bug_id FILTER xml %] + + [% bug.reporter_realname FILTER xml %] + + [% date.format(format=>"%Y-%m-%dT%H:%M:%SZ",time=>bug.changedtime, + gmt=>1) FILTER xml %] + + [%# Filter out the entire block, so that we don't need to escape the html code out %] + [% FILTER xml %] + + + + + + + + + + + + + + + + + + + + + + +
FieldValue
[% columns.opendate.title FILTER none %][% bug.opendate FILTER none %]
[% columns.assigned_to_realname.title FILTER none %][% bug.assigned_to_realname FILTER none %]
[% columns.priority.title FILTER none %][% bug.priority FILTER none %]
[% columns.bug_severity.title FILTER none %] [% bug.bug_severity FILTER none %]
[% columns.bug_status.title FILTER none %][% bug.bug_status FILTER none %]
[% columns.changeddate.title FILTER none %][% bug.changeddate FILTER none -%]
+ [% END %] + + + [% END %] + diff --git a/template/en/default/list/list.html.tmpl b/template/en/default/list/list.html.tmpl index 85b7d7316..5ac715a0c 100644 --- a/template/en/default/list/list.html.tmpl +++ b/template/en/default/list/list.html.tmpl @@ -48,15 +48,15 @@ [% PROCESS global/header.html.tmpl title = title style = style - rsslink = "buglist.cgi?$urlquerypart&title=$title&ctype=rss" + atomlink = "buglist.cgi?$urlquerypart&title=$title&ctype=atom" %]
- [% IF Param('timezone') %] - [% time2str("%a %b %e %Y %T %Z", currenttime, Param('timezone')) %]
- [% ELSE %] - [% time2str("%a %b %e %Y %T", currenttime) %]
- [% END %] + [% IF Param('timezone') %] + [% time2str("%a %b %e %Y %T %Z", currenttime, Param('timezone')) %]
+ [% ELSE %] + [% time2str("%a %b %e %Y %T", currenttime) %]
+ [% END %] [% IF debug %]

@@ -169,7 +169,7 @@ [% urlquerypart FILTER html %]&ctype=csv">CSV | RSS | + [%- title FILTER html %]&ctype=atom">Feed | iCalendar | - # John Belmonte - # Jason Remillard - # - # This is a template for generating an RSS 1.0 representation of a buglist. - #%] - -[% PROCESS global/variables.none.tmpl %] -[% USE date %] - -[% DEFAULT title = "$terms.Bugzilla $terms.Bugs" %] - - - - - - [% title FILTER xml %] - [% "$terms.Bugzilla $terms.bug list" FILTER xml %] - - [% Param('urlbase') %]buglist.cgi? - [%- urlquerypart.replace('ctype=rss[&]?','') FILTER xml -%] - - - hourly - 2 - - - - [% FOREACH bug = bugs %] - - [% END %] - - - - - - [% FOREACH bug = bugs %] - - - [% "@" IF bug.secure_mode %] [[% terms.Bug %] [%+ bug.bug_id FILTER xml %]] [% bug.short_desc FILTER xml %] - - [% Param('urlbase') FILTER xml %]show_bug.cgi?id=[% bug.bug_id FILTER xml %] - [% bug.reporter_realname FILTER xml %] - [% date.format(format=>"%Y-%m-%dT%H:%MZ",time=>bug.opentime,gmt=>1) FILTER xml %] - - [%# Filter out the entire block, so that we don't need to escape the html code out %] - [% FILTER xml %] - - - - - - - - - - - - - - - - - - - - - - -
FieldValue
[% columns.opendate.title FILTER none %][% bug.opendate FILTER none %]
[% columns.assigned_to_realname.title FILTER none %][% bug.assigned_to_realname FILTER none %]
[% columns.priority.title FILTER none %][% bug.priority FILTER none %]
[% columns.bug_severity.title FILTER none %] [% bug.bug_severity FILTER none %]
[% columns.bug_status.title FILTER none %][% bug.bug_status FILTER none %]
[% columns.changeddate.title FILTER none %][% bug.changeddate FILTER none -%]
- [% END %] - - - [% END %] - -- cgit v1.2.3-24-g4f1b