Skip to content

Commit

Permalink
Fixed issue #16611: not possible anymore to add xss when updating use…
Browse files Browse the repository at this point in the history 
…rs fullname in usermanagement (small change)
  • Loading branch information
@Trischi80
Trischi80 committed Aug 25, 2020
1 parent bbc89a2 commit 417388c
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion application/controllers/UserManagementController.php
View file
Expand Up @@ -1049,7 +1049,7 @@ public function updateAdminUser($aUser)
throw new CException("This action is not allowed, and should never happen", 500);
}

$aUser['full_name'] = flattenText($aUser['users_name']); //to prevent xss ...
$aUser['full_name'] = flattenText($aUser['full_name']); //to prevent xss ...
$oUser->setAttributes($aUser);

if (isset($aUser['password']) && $aUser['password']) {
Expand Down

3 comments on commit 417388c

@mattaberegg
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Other areas of this application are still vulnerable to the XSS filter bypass mentioned in the bug report linked to this commit. Following the steps to recreate from this bug report (https://bugs.limesurvey.org/view.php?id=16591) will still trigger an XSS vulnerability when using the filter bypass payload described in this report (https://bugs.limesurvey.org/view.php?id=16611).

@Shnoulle
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But more : XSS must be fixed in View, not controller …

@mattaberegg
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, more information on implementing output encoding can be found in the "Remediation Resources" section of the linked reports above or here if needed: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html

Please sign in to comment.