463069 - (WH-1628756) XSS vulns on tiki-browse_categories.php

Status: VERIFIED FIXED

(support.mozilla.org :: Knowledge Base Software, task)

Description

[Reed Loden [:reed]]

https://support.mozilla.com/tiki-browse_categories.php?find=%22%20STYLE=%22background-image:%20x(a:whs())&deep=off&type=&parentId=13&offset=930&sort_mode=name_asc

https://support.mozilla.com/tiki-browse_categories.php?find=&deep=off&type=&parentId=%22%20STYLE=%22background-image:%20x(a:whs())&offset=930&sort_mode=name_asc

Comment 1

[Laura Thomson :laura]

Sadly, the fix for the first three bugs doesn't fix this one.

Comment 2

[Laura Thomson :laura]

More to the point, the first one is fixed but the second one isn't.  Not too hard to iron out I hope.

Comment 3

[Laura Thomson :laura]

Attachment: Fix unescaped stuff in the templates.

Comment 4

[Laura Thomson :laura]

Committed in r19632.

Comment 5

[Stephen Donner [:stephend] Not actively reading bugmail]

[1] https://support-stage.mozilla.org/tiki-browse_categories.php?find=%22%20STYLE=%22background-image:%20x%28a:whs%28%29%29&deep=off&type=&parentId=13&offset=930&sort_mode=name_asc:

"Error

An unexpected error has occurred!"

[2] https://support-stage.mozilla.org/tiki-browse_categories.php?find=&deep=off&type=&parentId=%22%20STYLE=%22background-image:%20x%28a:whs%28%29%29&offset=930&sort_mode=name_asc:

"Choose a category
Top  :: 

<< 
<<"

I couldn't ever reproduce [1], but Laura mentions that in comment 2; [2] I could reproduce on production:

"Choose a category
admin category
Top  :: 

Set email notifications for this category: watch this category Currently off"

Verified FIXED

Comment 6

[Yvan Boily [:ygjb][:yvan]]

Adding keywords to bugs for metrics, no action required.  Sorry about bugmail spam.

Comment 7

[Will Kahn-Greene [:willkg] ET needinfo? me]

These bugs are all resolved, so I'm removing the security flag from them.