511650 - Forum usernames should be valid UTF-8

Status: RESOLVED WORKSFORME

(support.mozilla.org :: General, defect)

Description

[Matthew Middleton (:zzxc)]

Forum usernames aren't being properly converted to UTF-8, resulting in XML parsing errors on affected pages.  This is seen in the "Live Chat pings" XML document at https://support.mozilla.com/tiki-forum_livechat_pings.php , as well as on individual forum threads.

The forum thread at https://support.mozilla.com/tiki-view_forum_thread.php?comments_parentId=419066&forumId=1 contains a username with ISO_8859-1 characters, such as 0xE8, that weren't converted to UTF-8.  (0xE8 is è in ISO-8859, but it is a start of a multibyte sequence in UTF-8)

Marking as security sensitive, since allowing mixed-encoding strings could conceivably allow an attacker to defeat TikiWiki's tag stripping or create adodb errors.

Comment 1

[James Socol [:jsocol, :james]]

None of this code is currently in use. And we're 100% on UTF-8, now, no Latin-1 lingering about.

Comment 2

[Will Kahn-Greene [:willkg] ET needinfo? me]

These bugs are all resolved, so I'm removing the security flag from them.