Closed Bug 403291 Opened 17 years ago Closed 17 years ago

tiki-searchresults.php vulnerable to content injection

Categories

(support.mozilla.org :: Knowledge Base Software, task, P1)

Product:
support.mozilla.org
Component:
Knowledge Base Software
Type:
task

Tracking

(Not tracked)

Status:
VERIFIED FIXED

People

(Reporter: rflint, Assigned: nkoth)

References

(
URL
)

Details

(Whiteboard: tiki_test) 

See the URL field for an example. This script currently doesn't sanitize quotes or HTML, allowing an attacker to display their own content in the search results.
Nelson, can you take a look at this?
Assignee: nobody → nelson
Priority: -- → P1
Target Milestone: --- → 0.2
Fixed in support-stage, will be included in the next sync.
Status: NEW → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
Turns out this was fixed on support.mozilla.com already.
Status: RESOLVED → VERIFIED
Group: webtools-security → websites-security
Group: websites-security
Group: websites-security
Whiteboard: tiki_triage
Whiteboard: tiki_triage → tiki_test
These bugs are all resolved, so I'm removing the security flag from them.
Group: websites-security
You need to log in before you can comment on or make changes to this bug.