Project

General

Profile

Actions
Copy link

Bug #13262

closed
JP JP

File browser on ``diag_edit.php`` does not encode filenames before display

Bug #13262: File browser on ``diag_edit.php`` does not encode filenames before display

Added by Jim Pingle over 4 years ago. Updated over 3 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Jim Pingle
Category:
Diagnostics
Target version:
2.7.0
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
23.01
Release Notes:
Default
Affected Version:
Affected Architecture:

Description

The file browser on diag_edit.php does not encode filenames before display.

A user who can create files with arbitrary names can break rendering of the page though exploit potential is minimized by the fact that `/` is not valid in filenames so tags cannot be closed.

A file with the following name can trigger a JS alert: <img src=src onerror=alert(1)>, for example.

Actions
Copy link

Also available in: Atom