0011299: "IRC Chat" URL not correctly encoded

ID	Project	Category	View Status	Date Submitted	Last Update
0011299	mantisbt	security	public	2009-12-22 12:41	2010-12-17 04:40

Reporter	dolmen	Assigned To	dhx
Priority	high	Severity	major	Reproducibility	always
Status	closed	Resolution	fixed
Product Version	1.2.3
Target Version	1.2.4	Fixed in Version	1.2.4

Summary	0011299: "IRC Chat" URL not correctly encoded
Description	The "IRC Chat" link on this Mantis installation is not correctly encoded: '&' are not escaped as '&'. If this link is entered by configuration, this may be an XSS issue, in particular if other HTML special characters are not escaped (<>"). This is one of the issues I found using the W3C HTML Validator. I'm using it though the Firefox Web developer Toolbar, menu "Tools", "Validate local HTML" (this enable to easily validate pages that require an authenticated session).
Steps To Reproduce	View the HTML source of any page in a session at http://www.mantisbt.org/bugs/
Tags	No tags attached.

dolmen 2009-12-22 13:28 reporter ~0023966	The bug is in core/html_api.php in function prepare_custom_menu_options(): $t_link and $t_caption should be processed with string_html_specialchars().

dhx 2010-09-18 01:39 reporter ~0026769	Thanks Olivier, I have committed a patch to solve this issue. Sorry for the delay too. It isn't really a security concern however.

MantisBT: master 544e76d9 2010-09-18 01:32 dolmen Committer: dhx Details Diff	Fix 0011299: Custom menu links should be sanitised before output If an administrator defines custom menu links (consisting of a caption and URL) then these values should be escaped of special HTML characters before being printed into the menu. This XSS issue is of no security concern as it requires administrator access and manual modifications to the configuration file. Co-contributed-by: David Hicks <hickseydr@optusnet.com.au> Signed-off-by: David Hicks <hickseydr@optusnet.com.au>	Affected Issues 0011299
	mod - core/html_api.php	Diff File
MantisBT: master-1.2.x d37df257 2010-09-18 01:32 dolmen Committer: dhx Details Diff	Fix 0011299: Custom menu links should be sanitised before output If an administrator defines custom menu links (consisting of a caption and URL) then these values should be escaped of special HTML characters before being printed into the menu. This XSS issue is of no security concern as it requires administrator access and manual modifications to the configuration file. Co-contributed-by: David Hicks <hickseydr@optusnet.com.au> Signed-off-by: David Hicks <hickseydr@optusnet.com.au>	Affected Issues 0011299
	mod - core/html_api.php	Diff File