Skip to content
This repository was archived by the owner on Jun 3, 2020. It is now read-only.

Commit dd41838

Browse files
committed
1181152 - XSS when altering user details and going somewhere where you are choosing user
- Escaped tags in real names
1 parent 977383f commit dd41838

File tree

8 files changed

+8
-8
lines changed

8 files changed

+8
-8
lines changed

Diff for: backend/server/rhnPackage.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -203,7 +203,7 @@ def get_info_for_package(pkg, channel_id, org_id):
203203
'channel_id': channel_id,
204204
'org_id': org_id}
205205
# yum repo has epoch="0" not only when epoch is "0" but also if it's NULL
206-
if pkg[3] == '0' or pkg[3] == '':
206+
if pkg[3] == '0' or pkg[3] == '' or pkg[3]==None:
207207
epochStatement = "(epoch is null or epoch = :epoch)"
208208
else:
209209
epochStatement = "epoch = :epoch"

Diff for: java/code/webapp/WEB-INF/pages/admin/multiorg/org_users.jsp

+1-1
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@
7878
sortable="false"
7979
headerkey="realname.displayname"
8080
attr="userLastName">
81-
<c:out value="${current.userDisplayName}" escapeXml="false" />
81+
<c:out value="${current.userDisplayName}" escapeXml="true" />
8282
</rl:column>
8383
<rl:column bound="false"
8484
sortable="false"

Diff for: java/code/webapp/WEB-INF/pages/admin/multiorg/sat_org_users.jsp

+1-1
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@
5555
sortable="false"
5656
headerkey="realname.displayname"
5757
attr="userLastName">
58-
<c:out value="<a href=\"mailto:${current.address}\">${current.userLastName}, ${current.userFirstName}</a>" escapeXml="false"/>
58+
<c:out value="<a href=\"mailto:${current.address}\">${current.userLastName}, ${current.userFirstName}</a>" escapeXml="true"/>
5959
</rl:column>
6060
<rl:column bound="false"
6161
sortable="false"

Diff for: java/code/webapp/WEB-INF/pages/admin/users/activelist.jsp

+1-1
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@
4444
sortable="true"
4545
headerkey="realname.displayname"
4646
sortattr="userLastName">
47-
<c:out value="${current.userLastName}, ${current.userFirstName}" />
47+
<c:out escapeXml="true" value="${current.userLastName}, ${current.userFirstName}" />
4848
</rl:column>
4949

5050
<!-- Roles column -->

Diff for: java/code/webapp/WEB-INF/pages/common/fragments/manage/managers.jspf

+1-1
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@
3939
<rl:column sortable="false"
4040
bound="false"
4141
headerkey="realname.displayname" >
42-
${current.userLastName}, ${current.userFirstName}
42+
<c:out escapeXml="true" value="${current.userLastName},${current.userFirstName}" />
4343
</rl:column>
4444

4545
<rl:column sortable="false"

Diff for: java/code/webapp/WEB-INF/pages/common/fragments/manage/subscribers.jspf

+1-1
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@
3939
<rl:column sortable="false"
4040
bound="false"
4141
headerkey="realname.displayname" >
42-
${current.userLastName}, ${current.userFirstName}
42+
<c:out escapeXml="true" value="${current.userLastName},${current.userFirstName}" />
4343
</rl:column>
4444

4545
<rl:column sortable="false"

Diff for: java/code/webapp/WEB-INF/pages/common/fragments/user/userlist_columns.jspf

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
sortable="true"
55
headerkey="realname.displayname"
66
sortattr="userLastName">
7-
<c:out value="${current.userLastName}, ${current.userFirstName}" />
7+
<c:out escapeXml="true" value="${current.userLastName}, ${current.userFirstName}" />
88
</rl:column>
99

1010
<rl:column bound="true"

Diff for: java/code/webapp/WEB-INF/pages/groups/adminlist.jsp

+1-1
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@
5050
<rl:column sortable="false"
5151
bound="false"
5252
headerkey="realname.displayname" >
53-
${current.userLastName}, ${current.userFirstName}
53+
<c:out escapeXml="true" value="${current.userLastName},${current.userFirstName}" />
5454
</rl:column>
5555

5656
<rl:column sortable="true"

0 commit comments

Comments
 (0)