Skip to content

2.3.0

Latest
Latest

Choose a tag to compare

View all tags
@dereuromark dereuromark released this 05 May 01:49
· 16 commits to master since this release
2.3.0
95c27af
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Fixes

  • Stored XSS in admin listing. templates/Admin/Feedback/listing.php echoed several user-submitted fields without escaping: subject, feedback, screenshot (interpolated into an img src data URI), and url (interpolated into href and link text when Feedback.autoLink is enabled). An attacker submitting feedback with HTML/JS in any of those fields got script execution in the admin panel that views the listing — admin-targeted stored XSS reachable by any user able to submit feedback. Now wraps each value in h(), and autoLink requires a http(s):// scheme so javascript: / data: URLs are blocked even with the attribute escaped. Added rel="noopener noreferrer" on the new-tab links.
  • XSS in $name / $email value attributes in templates/element/sidebar.php. Both are sourced from session/AuthUser and any upstream component that lets an attacker influence those keys (e.g. an OAuth display name) reached every page rendering the widget unescaped.
  • Stored screenshot bytes echoed into data: URIs across Feedback/index.php, Feedback/viewimage.php, Admin/Feedback/viewimage.php, Admin/FeedbackItems/{viewimage,view}.php are now escaped. A submitter who replaced the legitimate base64 payload with attribute-breaking content otherwise persisted XSS for every user or admin who opened the feedback item.

Improvements

  • Admin UI and frontend sidebar widget are now strict-CSP compatible. Replaced 6 Form->postLink + confirm calls in admin templates with Form->postButton + data-confirm-message. Added nonce to inline <script> blocks in admin templates and the frontend sidebar widget (sourced from the cspNonce request attribute, falls back gracefully when no nonce is set). Replaced 3 inline onclick="return false;" handlers in the sidebar element with type="button" / data-feedback-nop + delegated listener. After this release, templates have zero inline style= attributes.
  • Switched all plugin-runtime __() calls to __d('feedback', ...) so translations resolve through the plugin's own i18n domain. Refreshed resources/locales/feedback.pot (~8 years stale, 25 → 56 unique msgids) and switched to --no-location for tidier diffs on regeneration. Existing de/, es/, nl/, sv/ packs are intentionally left for translators to msgmerge against.
  • Raised PHP minimum version

Full Changelog: 2.2.1...2.3.0

Assets 2
Loading