Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SECURITY][Bugfix:Forum] Fix Forum Links and Deletion #8032

Merged
merged 2 commits into from Jun 13, 2022
Merged

Conversation

cjreed121
Copy link
Member

@cjreed121 cjreed121 commented Jun 12, 2022

What is the current behavior?

Threads/posts could be deleted by a different user. Also it is possible to create links that could lead to XSS.

What is the new behavior?

Threads/posts can only be deleted by the author or an authorized user. Links are checked in the markdown renderer so XSS is not possible.

Other information?

Thanks Fu (@richcfno1) for pointing these out.

@codecov
Copy link

codecov bot commented Jun 12, 2022

Codecov Report

Merging #8032 (c5d7afe) into main (ceb26e9) will increase coverage by 0.29%.
The diff coverage is 33.33%.

Impacted file tree graph

@@             Coverage Diff              @@
##               main    #8032      +/-   ##
============================================
+ Coverage     22.12%   22.41%   +0.29%     
- Complexity     7569     7715     +146     
============================================
  Files           203      203              
  Lines         24734    25023     +289     
  Branches         60       60              
============================================
+ Hits           5472     5609     +137     
- Misses        19204    19356     +152     
  Partials         58       58              
Flag Coverage Δ
autograder 20.22% <ø> (ø)
js 31.34% <ø> (ø)
migrator 99.20% <ø> (+<0.01%) ⬆️
php 20.59% <33.33%> (+0.35%) ⬆️
python_submitty_utils 71.65% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

@bmcutler bmcutler merged commit 9c8199c into main Jun 13, 2022
@bmcutler bmcutler deleted the forum_bug_fixes branch June 13, 2022 02:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants