Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Browse files

Fix #15384: summary.php XSS vulnerability in MantisBT 1.2.12 only

Roland Becker (MantisBT Developer) discovered a XSS vulnerability
introduced in MantisBT 1.2.12 with the display of category/project names
on the summary.php page.

A malicious MantisBT user holding privileged manager/administrator
permissions could create a category or project name that contains
JavaScript code. Any user visiting summary.php from that point on may
then be exposed to having the malicious JavaScript execute within their
browser environment.

The severity of this issue is limited by the need to hold privileged
manager/administrator permissions in order to modify category and
project names. However -- there are many use cases where MantisBT
installations can have hundreds of sub-projects, each managed by
different people/parties that can not or should not be fully trusted.

Refer to previous commits 3ca8a16 and 6ec3f69 to trace back the origin
of this vulnerability.
  • Loading branch information...
commit 7df30a9ee703f4d48e6ef8df078cff3a6029c5b9 1 parent 610da6e
@davidhicks davidhicks authored
Showing with 5 additions and 5 deletions.
  1. +5 −5 core/summary_api.php
View
10 core/summary_api.php
@@ -626,9 +626,9 @@ function summary_print_by_category() {
$v_category_name = $row['category_name'];
if(( $v_category_name != $last_category_name ) && ( $last_category_name != -1 ) ) {
- $label = $last_category_name;
+ $label = string_display_line( $last_category_name );
if(( ON == $t_summary_category_include_project ) && ( ALL_PROJECTS == $t_project_id ) ) {
- $label = sprintf( '[%s] %s', project_get_name( $last_project ), $label );
+ $label = sprintf( '[%s] %s', string_display_line( project_get_name( $last_project ) ), $label );
}
$t_bug_link = '<a class="subtle" href="' . config_get( 'bug_count_hyperlink_prefix' ) . '&amp;' . FILTER_PROPERTY_CATEGORY . '=' . urlencode( $last_category_name );
@@ -671,9 +671,9 @@ function summary_print_by_category() {
}
if( 0 < $t_bugs_total ) {
- $label = $last_category_name;
+ $label = string_display_line( $last_category_name );
if(( ON == $t_summary_category_include_project ) && ( ALL_PROJECTS == $t_project_id ) ) {
- $label = sprintf( '[%s] %s', project_get_name( $last_project ), $label );
+ $label = sprintf( '[%s] %s', string_display_line( project_get_name( $last_project ) ), $label );
}
$t_bug_link = '<a class="subtle" href="' . config_get( 'bug_count_hyperlink_prefix' ) . '&amp;' . FILTER_PROPERTY_CATEGORY . '=' . urlencode( $last_category_name );
@@ -753,7 +753,7 @@ function summary_print_by_project( $p_projects = null, $p_level = 0, $p_cache =
}
foreach( $p_projects as $t_project ) {
- $t_name = str_repeat( "&raquo; ", $p_level ) . project_get_name( $t_project );
+ $t_name = str_repeat( "&raquo; ", $p_level ) . string_display_line( project_get_name( $t_project ) );
$t_pdata = isset( $p_cache[$t_project] ) ? $p_cache[$t_project] : array( 'open' => 0, 'resolved' => 0, 'closed' => 0 );
Please sign in to comment.
Something went wrong with that request. Please try again.