Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fixed issue #17676: Survey End URL Description gets scrambled if using html special chars #2130

Merged
merged 1 commit into from Nov 8, 2021
Merged

Fixed issue #17676: Survey End URL Description gets scrambled if using html special chars #2130

merged 1 commit into from Nov 8, 2021

Conversation

gabrieljenik
Copy link
Collaborator

No description provided.

@Shnoulle
Copy link
Collaborator

Shnoulle commented Nov 3, 2021

Must check what happen with
check" autofocus onfocus=alert(1)
data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+

(see https://hacksheets.in/all-categories/payloads-main/xss-payloads/)

@glimz glimz requested a review from Shnoulle November 5, 2021 08:51
Shnoulle
Shnoulle approved these changes Nov 5, 2021
View reviewed changes
Copy link
Collaborator

@Shnoulle Shnoulle left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code OK
Security not checked

@olleharstedt
Copy link
Collaborator

Hm, what was the commit message of the commit that added htmlspecialchars? Did I do that in reaction to a security report?

@gabrieljenik
Copy link
Collaborator Author

Hm, what was the commit message of the commit that added htmlspecialchars? Did I do that in reaction to a security report?

Not much detail: 4e74f67

@olleharstedt
Copy link
Collaborator

Weird. This was the original bug that Markus fixed: https://bugs.limesurvey.org/view.php?id=13136

@olleharstedt olleharstedt merged commit cf75767 into LimeSurvey:master Nov 8, 2021
@olleharstedt
Copy link
Collaborator

Will merge it for now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Shnoulle Shnoulle Shnoulle approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
4 participants
@gabrieljenik @Shnoulle @olleharstedt @encuestabizdevgit