MantisBT: master be4dbbf8

Author Committer Branch Timestamp Parent
dhx dhx master 2009-12-01 02:28 master 0789144e
Affected Issues  0011243: Default to sanitising column values on view_all_bug_page.php to prevent XSS attacks
Changeset

Fix 0011243: XSS on view_all_bug_page.php due to bad sanitising defaults

Columns on view_all_bug_page.php are not sanitised by default when there
is no special function defined for formatting and printing the column
value. This leads to a problem where a column such as 'version' can
introduce an XSS flaw when a malicious user has the ability to create
their own versions containing Javascript.

For columns with existing printing/formatting functions, these have been
improved with the use of string sanitisation where applicable.

mod - core/custom_function_api.php Diff File
mod - core/columns_api.php Diff File