MantisBT: master-1.2.x b66d1b04

Author Committer Branch Timestamp Parent
dhx dhx master-1.2.x 2009-12-01 02:28 master-1.2.x 9c0f46d6
Affected Issues  0011243: Default to sanitising column values on view_all_bug_page.php to prevent XSS attacks
Changeset

Fix 0011243: XSS on view_all_bug_page.php due to bad sanitising defaults

Columns on view_all_bug_page.php are not sanitised by default when there
is no special function defined for formatting and printing the column
value. This leads to a problem where a column such as 'version' can
introduce an XSS flaw when a malicious user has the ability to create
their own versions containing Javascript.

For columns with existing printing/formatting functions, these have been
improved with the use of string sanitisation where applicable.

mod - core/custom_function_api.php Diff File
mod - core/columns_api.php Diff File