View Issue Details

WikiJump to Notes
IDProjectCategoryView StatusDate SubmittedLast Update
0012234mantisbtsecuritypublic2010-08-04 15:542011-08-02 12:35
Reporteratrol Assigned Todhx  
PriorityhighSeveritymajorReproducibilityalways
Status closedResolutionfixed 
Product Version1.2.2 
Fixed in Version1.2.3 
Summary0012234: XSS issues when using custom field String values
Description

Scripting code entered in custom field String is executed when displaying HTML-Report

Steps To Reproduce
  1. Add a custom field with type String to a project
  2. Add the column to the "Print Issues Columns"
  3. Enter an issue with scripting code in custom field
  4. Select "View Issues"
  5. Select "Print Reports"
  6. Click on the IE icon
  7. See your code beeing executed
TagsNo tags attached.

Activities

dhx

dhx

2010-08-05 04:16

reporter   ~0026219

I cannot reproduce this problem with the latest 1.2.x and 1.3.x releases.

Perhaps this is a duplicate of 0012232 which I fixed yesterday?
atrol

atrol

2010-08-05 05:56

developer   ~0026221

I don't think it's a duplicate bececause 0012232 fixes a problem with enumeration values. This one is for string values. I had a short look at your patch. Maybe this fixed also this problem because you changed function cfdef_input_textbox.
The next few days I will try a nightly build and give you feedback.
dhx

dhx

2010-08-05 09:58

reporter   ~0026223

Yep I didn't just fix enumeration values... I fixed them all.

So I guess I fixed the same issue you came across too :)
atrol

atrol

2010-08-05 11:39

developer   ~0026227

Checked with nightly build http://www.mantisbt.org/builds/mantisbt-1.2.2-2010-08-05-master-1.2.x-9fc1dd8.zip
String problem is also fixed
Thank you