Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SECURITY: XSS when $wgPiwikTrackUsernames is true #17

Merged
merged 1 commit into from Nov 15, 2017

Conversation

Seb35
Copy link
Collaborator

@Seb35 Seb35 commented Oct 28, 2017

With a specially-crafted username like 0'+(window.alert('You have been hacked'))+'0 the user receives the alert "You have been hacked". This commit escapes the username.

With a specially-crafted username like 0'+(window.alert('You have been hacked'))+'0
the user receives the alert "You have been hacked". This commit escapes the
username.
@Seb35
Copy link
Collaborator Author

Seb35 commented Nov 15, 2017

A screenshot of a specific username; look at the username in the personal bar.
xss sur l extension piwik a1d4218

@Seb35 Seb35 merged commit 681324e into DaSchTour:master Nov 15, 2017
@Seb35 Seb35 deleted the fix-xss-usernames branch November 15, 2017 18:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant