Project

General

Profile

Actions
Copy link

Bug #10324

closed

system_usermanager_addprivs.php: User account full name is not encoded before output

Added by Jim Pingle about 6 years ago. Updated almost 6 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Jim Pingle
Category:
User Manager / Privileges
Target version:
2.4.5
Start date:
03/09/2020
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
All
Affected Architecture:
All

Description

On system_usermanager_addprivs.php, the user name and full name are displayed at the top of the page for reference. The full name is not encoded before output, leading to a potential XSS.

Actions
Copy link
 #1

Updated by Jim Pingle about 6 years ago

  • Target version set to 2.4.5
Actions
Copy link
 #2

Updated by Jim Pingle about 6 years ago

  • Status changed from Confirmed to Feedback
  • % Done changed from 0 to 100

Fixed by commit:3c1e53dabe966f27c9097a5a923e77f49ae5fffa (master) and commit:63b2d08b84b5c1707db809209d7a30569ec2e1e1 (RELENG_2_4_5)

Actions
Copy link
 #3

Updated by Jim Pingle about 6 years ago

  • Status changed from Feedback to Resolved

OK on 2.4.5.r.20200309.1200
OK on 2.5.0 via gitsync

Actions
Copy link
 #4

Updated by Jim Pingle almost 6 years ago

  • Private changed from Yes to No
Actions
Copy link

Also available in: Atom PDF