From f3b17d9f5351d9eca8d2c7f0feb272432fc398c9 Mon Sep 17 00:00:00 2001 From: Frédéric Buclin Date: Sat, 12 Oct 2013 00:13:42 +0200 Subject: Bug 912640: Release notes for Bugzilla 4.2.7 r=dkl a=LpSolit --- template/en/default/pages/release-notes.html.tmpl | 30 +++++++++++++++++++++++ 1 file changed, 30 insertions(+) (limited to 'template') diff --git a/template/en/default/pages/release-notes.html.tmpl b/template/en/default/pages/release-notes.html.tmpl index 3d5b36b45..ebc08afb1 100644 --- a/template/en/default/pages/release-notes.html.tmpl +++ b/template/en/default/pages/release-notes.html.tmpl @@ -53,6 +53,36 @@

Updates in this 4.2.x Release

+

4.2.7

+ +

This release fixes several security issues. See the + Security Advisory + for details.

+ +

In addition, the following [% terms.bugs %] have been fixed in this release:

+ + +

4.2.6

The following important fixes/changes have been made in this release:

-- cgit v1.2.3-24-g4f1b From 3771585c730f31f36a5efa3bd6b053ddf66bb2ba Mon Sep 17 00:00:00 2001 From: Dave Lawrence Date: Wed, 16 Oct 2013 12:05:10 -0400 Subject: Bug 906745 - In MySQL, tokens are not case-sensitive, reducing total entropy and allowing easier brute force r=LpSolit,a=glob --- template/en/default/global/code-error.html.tmpl | 3 +++ 1 file changed, 3 insertions(+) (limited to 'template') diff --git a/template/en/default/global/code-error.html.tmpl b/template/en/default/global/code-error.html.tmpl index 24e46fb14..877fe8d66 100644 --- a/template/en/default/global/code-error.html.tmpl +++ b/template/en/default/global/code-error.html.tmpl @@ -438,6 +438,9 @@ [% ELSIF error == "token_generation_error" %] Something is seriously wrong with the token generation system. + [% ELSIF error == "cancel_token_does_not_exist" %] + The token to be cancelled does not exist. + [% ELSIF error == "template_error" %] [% template_error_msg FILTER html %] -- cgit v1.2.3-24-g4f1b From 53eeca9fc9a12ae23a0aa66f1b38021e93d4f03c Mon Sep 17 00:00:00 2001 From: Frédéric Buclin Date: Wed, 16 Oct 2013 19:19:12 +0200 Subject: Bug 924802: (CVE-2013-1742) [SECURITY] (XSS) "id" and "sortkey" are not sanitized when editing flag types if categoryAction-foo is set r=dkl a=glob --- template/en/default/admin/flag-type/edit.html.tmpl | 6 +++--- template/en/default/filterexceptions.pl | 2 -- 2 files changed, 3 insertions(+), 5 deletions(-) (limited to 'template') diff --git a/template/en/default/admin/flag-type/edit.html.tmpl b/template/en/default/admin/flag-type/edit.html.tmpl index 2cb985a47..de0476e19 100644 --- a/template/en/default/admin/flag-type/edit.html.tmpl +++ b/template/en/default/admin/flag-type/edit.html.tmpl @@ -52,7 +52,7 @@
- + @@ -149,8 +149,8 @@ this type will be sorted when displayed to users in a list; ignore if you don't care what order the types appear in or if you want them to appear in alphabetical order.
- + diff --git a/template/en/default/filterexceptions.pl b/template/en/default/filterexceptions.pl index 691241c9c..897ab148e 100644 --- a/template/en/default/filterexceptions.pl +++ b/template/en/default/filterexceptions.pl @@ -410,8 +410,6 @@ ], 'admin/flag-type/edit.html.tmpl' => [ - 'type.id', - 'type.sortkey || 1', 'selname', ], -- cgit v1.2.3-24-g4f1b From 3b9eb2e03904a12cf38268b2527742e5ede7f305 Mon Sep 17 00:00:00 2001 From: Frédéric Buclin Date: Wed, 16 Oct 2013 19:26:25 +0200 Subject: Bug 924932: (CVE-2013-1743) [SECURITY] Field values are (still) not escaped correctly in tabular reports r=dkl a=glob --- template/en/default/reports/report-table.html.tmpl | 38 ++++++++++++++-------- 1 file changed, 24 insertions(+), 14 deletions(-) (limited to 'template') diff --git a/template/en/default/reports/report-table.html.tmpl b/template/en/default/reports/report-table.html.tmpl index b41753550..cef47c2d9 100644 --- a/template/en/default/reports/report-table.html.tmpl +++ b/template/en/default/reports/report-table.html.tmpl @@ -47,32 +47,42 @@ [% END %]