Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

XSS Vulnerability #127

Closed
splitbrain opened this issue Nov 27, 2015 · 1 comment
Closed

XSS Vulnerability #127

splitbrain opened this issue Nov 27, 2015 · 1 comment
Labels
bug resolved

Comments

@splitbrain
Copy link

Judging this http://php-grinder.com/vulns/view/1174584 it seems to me that a user can introduce malicious script code into the wiki by adding script to his own real name. The values should properly escaped.
@giterlizzi giterlizzi added the bug label Nov 27, 2015
giterlizzi added a commit that referenced this issue Nov 27, 2015
@giterlizzi
Escaped the fullname of DokuWiki user to prevent an XSS vulnerability…
a80e201 
… (thanks to @splitbrain on #127 issue)
@giterlizzi
Copy link
Owner

Hi Andreas! Thanks for reporting this critical issue and ... thanks for DokuWiki!

giterlizzi added a commit that referenced this issue Nov 28, 2015
@giterlizzi
Escaped REMOTE_USER to prevent an XSS vulnerability (thanks to @split…
d9c9906 
…brain on #127 issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug resolved
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@splitbrain @giterlizzi