Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

XSS protection added #58

Merged
merged 1 commit into from
May 7, 2019
Merged

XSS protection added #58

merged 1 commit into from
May 7, 2019

Conversation

efms
Copy link

@efms efms commented May 7, 2019

Malicious sysadmin could inject javascript code in ldap users' attributes.
Patch :

  • Used the SMARTY3 html escape mechanism (called in index.php).
  • Force use of the html escape function in value_displayer.pl to mail XSS injection.

@coudot coudot self-assigned this May 7, 2019
@coudot coudot added this to the 0.3 milestone May 7, 2019
@coudot coudot merged commit 9902750 into ltb-project:master May 7, 2019
@coudot
Copy link
Member

coudot commented May 7, 2019

Thanks a lot for your contribution!

@efms
Copy link
Author

efms commented May 9, 2019 •
edited
Loading

⚠️ Warning : with this fix, the HTML-Based attributes' values will not work anymore (for instance, a description containing HTML will display html tags, not render it)

@efms efms deleted the patchXSSinjection branch June 6, 2019 13:42
@coudot coudot mentioned this pull request Jul 22, 2019
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@coudot coudot

Labels
enhancement security
Projects
None yet
Milestone
0.3
Development

Successfully merging this pull request may close these issues.
2 participants
@efms @coudot