mbirth/LuckyCoinkydink
Archived
1
0
Fork 0
Code Issues Pull Requests Activity

Fix missing escaping (possible XSS) of category names in the Backend

Browse Source 
Entry Admin, which would allow editors that create a forged
category name to attack other editors in the backend (privileged
access to the backend required).
Thanks a lot to Edric Teo for reporting this issue.
This commit is contained in:
Garvin Hicking
2015-03-12 10:15:31 +01:00
parent d84cd93c57
commit bdd6c4fb17
2 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
docs/NEWS
View File

@@ -39,6 +39,12 @@ Version 2.1 ()
Version 2.0.1 ()
------------------------------------------------------------------------
* Fix missing escaping (possible XSS) of category names in the Backend
Entry Admin, which would allow editors that create a forged
category name to attack other editors in the backend (privileged
access to the backend required).
Thanks a lot to Edric Teo for reporting this issue.
* Improved detection for possible upgrade/plugin/PHP errors. A
warning will be emitted on the dashboard, when the Serendipity
JavaScript-library could not be loaded.

2
templates/2k11/admin/entries.tpl
View File

@@ -141,7 +141,7 @@
<span class="cat_view_pad">{$entry_cat.depth_pad}</span>
<input id="serendipity_category_{$entry_cat.categoryid}" name="serendipity[categories][]" type="checkbox" value="{$entry_cat.categoryid}"{if $entry_cat.is_selected} checked="checked"{/if}>
<label for="serendipity_category_{$entry_cat.categoryid}">{$entry_cat.category_name}</label>
<label for="serendipity_category_{$entry_cat.categoryid}">{$entry_cat.category_name|escape}</label>
</div>
{/foreach}
</fieldset>