From 9244270a7d1ca49e315a98c24d51bf405bfa2880 Mon Sep 17 00:00:00 2001 From: Frédéric Buclin Date: Mon, 24 Jan 2011 19:29:39 +0100 Subject: Bug 619588: (CVE-2010-4567) [SECURITY] Safety checks that disallow clicking for javascript: or data: URLs in the URL field can be evaded with prefixed whitespace and Bug 628034: (CVE-2011-0048) [SECURITY] For not-logged-in users, the URL field doesn't safeguard against javascript: or data: URLs r=dkl a=LpSolit --- template/en/default/bug/edit.html.tmpl | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) (limited to 'template/en/default/bug/edit.html.tmpl') diff --git a/template/en/default/bug/edit.html.tmpl b/template/en/default/bug/edit.html.tmpl index 1ae71b299..0aa5f80af 100644 --- a/template/en/default/bug/edit.html.tmpl +++ b/template/en/default/bug/edit.html.tmpl @@ -555,12 +555,10 @@ [%# Block for URL Keyword and Whiteboard #%] [%############################################################################%] [% BLOCK section_url_keyword_whiteboard %] -[%# *** URL Whiteboard Keywords *** %]