Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Escape user editable field #12739

Merged
merged 1 commit into from Apr 11, 2021

Conversation

murrant
Copy link
Member

@murrant murrant commented Apr 10, 2021

https://community.librenms.org/t/vulnerability-report-cross-site-scripting-xss-in-the-api-access-page/15431

DO NOT DELETE THE UNDERLYING TEXT

Please note

Please read this information carefully. You can run ./lnms dev:check to check your code before submitting.

  • Have you followed our code guidelines?
  • If my Pull Request does some changes/fixes/enhancements in the WebUI, I have inserted a screenshot of it.

Testers

If you would like to test this pull request then please run: ./scripts/github-apply <pr_id>, i.e ./scripts/github-apply 5926
After you are done testing, you can remove the changes with ./scripts/github-remove. If there are schema changes, you can ask on discord how to revert.

@murrant murrant changed the title escape user editable field Escape user editable field Apr 10, 2021
Copy link
Contributor

@PipoCanaja PipoCanaja left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Tested successfully, vulnerability fixed.

@librenms-bot
Copy link

This pull request has been mentioned on LibreNMS Community. There might be relevant details there:

https://community.librenms.org/t/vulnerability-report-cross-site-scripting-xss-in-the-api-access-page/15431/2

@Jellyfrog Jellyfrog merged commit 0e79413 into librenms:master Apr 11, 2021
11 checks passed
@murrant murrant deleted the security-api-js-injection branch April 12, 2021 13:49
@librenms-bot
Copy link

This pull request has been mentioned on LibreNMS Community. There might be relevant details there:

https://community.librenms.org/t/21-4-0-changelog/15528/1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants