Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
Fix XSS in manage_user_page.php (CVE-2017-12062)
trichimtrich (https://twitter.com/trichimtrich) reported this
vulnerability, allowing an attacker to inject arbitrary code through a
crafted 'filter' form variable.

Prevent the attack by sanitizing the variable before output.

Fixes #23166

Signed-off-by: Damien Regad <dregad@mantisbt.org>
  • Loading branch information
atrol authored and dregad committed Aug 1, 2017
1 parent 063cce6 commit 9b5b71d
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion manage_user_page.php
Expand Up @@ -272,7 +272,7 @@
<input type="hidden" name="sort" value="<?php echo $c_sort ?>" />
<input type="hidden" name="dir" value="<?php echo $c_dir ?>" />
<input type="hidden" name="save" value="1" />
<input type="hidden" name="filter" value="<?php echo $f_filter ?>" />
<input type="hidden" name="filter" value="<?php echo string_attribute( $f_filter ); ?>" />
<label class="inline">
<input type="checkbox" class="ace" name="hideinactive" value="<?php echo ON ?>" <?php check_checked( (int)$c_hide_inactive, ON ); ?> />
<span class="lbl"> <?php echo lang_get( 'hide_inactive' ) ?></span>
Expand Down

0 comments on commit 9b5b71d

Please sign in to comment.