Left angle bracket "<" causes remaining characters of password to be omitted

[ghost]

To reproduce:

• Create a new account or edit an existing one
• Include a left angle bracket "<" somewhere in the middle of your password. For example the password "pass<word" will do.
• Save the the account

Outcome:

• The characters of the password after and including the left angle bracket are missing when viewing the password. For example the above mentioned password would show as "pass"

Expected:

• The entire original password should be shown when viewing a saved password.

[nuxsmin]

Hi!!

I've noticed that passwords were also "sanitized" for malicious code. It has been patched and will be available in short.

Thank you for the feedback

[ghost]

Thanks,

This fixed most of the problem, the angle brackets are now being returned (I can see them in the page source) but they still do not show.

The problem seems to be that they're not escaped. I think I've fixed the problem but I don't know the software well enough to test thoroughly. Please see the diff below, this change seems to fix the problem completely.

diff --git a/ajax/ajax_viewpass.php b/ajax/ajax_viewpass.php
index 6a0c1e4..4277a96 100644
--- a/ajax/ajax_viewpass.php
+++ b/ajax/ajax_viewpass.php
@@ -94,10 +94,10 @@ if ($fullTxt) {
         </tr>
         <tr>
             <td><span class="altTxtBlue">' . _('Clave') . '</span></td>
-            <td>' . trim($accountClearPass) . '</td>
+            <td>' . htmlentities(trim($accountClearPass)) . '</td>
         </tr>
         </table>';
     echo '</div>';
 } else {
     echo trim($accountClearPass);
-}
\ No newline at end of file
+}

[nuxsmin]

Hi!!, I've already patched the stable release.

Thank you for your support!

[Naelwan]

Hi again,
I have the same issues even though I'm running the latest release.

"Pass<word" is shown as "Pass"
"Pass<<word" is shown as "Pass<"

And after verification, it does the same on http://demo.syspass.org/index.php

[nuxsmin]

@Naelwan unfortunatelly a parameter in the ajax request was malformed...

Solved in last commit

[Naelwan]

Thank you !