From ecaf3819ef8907f91134d61453f4e31e630c3c30 Mon Sep 17 00:00:00 2001 From: "lpsolit%gmail.com" <> Date: Mon, 5 May 2008 05:05:48 +0000 Subject: Bug 425665: [SECURITY] XSS in show_bug.cgi: id isn't filtered for format=multiple - Patch by Frédéric Buclin r=mkanat r=wurblzap a=LpSolit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- template/en/default/bug/show-multiple.html.tmpl | 6 +++--- template/en/default/filterexceptions.pl | 1 - 2 files changed, 3 insertions(+), 4 deletions(-) (limited to 'template') diff --git a/template/en/default/bug/show-multiple.html.tmpl b/template/en/default/bug/show-multiple.html.tmpl index 2562903a6..1442cae4f 100644 --- a/template/en/default/bug/show-multiple.html.tmpl +++ b/template/en/default/bug/show-multiple.html.tmpl @@ -36,12 +36,12 @@ [% ids = [] %] [% FOREACH bug = bugs %] [% PROCESS bug_display %] - [% ids.push(bug.bug_id) %] + [% ids.push(bug.bug_id) UNLESS bug.error %] [% END %] [% IF ids.size > 1 %]
- +
@@ -63,7 +63,7 @@ [% BLOCK bug_display %]

[% terms.Bug %] - [% bug.bug_id %] + [% bug.bug_id FILTER html %] [% IF Param("usebugaliases") AND bug.alias AND NOT bug.error %] ( [% bug.alias FILTER html %]) diff --git a/template/en/default/filterexceptions.pl b/template/en/default/filterexceptions.pl index 2fb8b48e0..c25e400c3 100644 --- a/template/en/default/filterexceptions.pl +++ b/template/en/default/filterexceptions.pl @@ -326,7 +326,6 @@ ], 'bug/show-multiple.html.tmpl' => [ - 'bug.bug_id', 'attachment.id', 'flag.status', ], -- cgit v1.2.3-24-g4f1b