MantisBT: master-2.21 bd094ded

Diff Back to Repository
Author Committer Branch Timestamp Parent
atrol dregad master-2.21 2019-08-25 01:52 master-2.21 b39d8720
Affected Issues  0026078: CVE-2019-15539: Stored XSS on Project Documentation
Changeset

Fix XSS on project documentation

Vulnerability in deprecated project documentation functionality
($g_enable_project_documentation), allowing execution of arbitrary
code (if CSP settings permit it) after uploading an attachment with a
crafted filename.

Prevent the attack by sanitizing the filename before display.

Fixes 0026078
mod - proj_doc_edit_page.php Diff File