Reported by Dionach.
Created attachment 53910 [details] [review] Bug 17024: Fix XSS in tools/viewlog.pl Test plan: Hit /tools/viewlog.pl?do_it=1&modules=CATALOGUING&action=MODIFY&object=<script>alert("XSS")</script> => Without this patch you will see the alert => With this patch, no more alert
Created attachment 53971 [details] [review] Bug 17024: Fix XSS in tools/viewlog.pl Test plan: Hit /tools/viewlog.pl?do_it=1&modules=CATALOGUING&action=MODIFY&object=<script>alert("XSS")</script> => Without this patch you will see the alert => With this patch, no more alert Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Created attachment 53973 [details] [review] [PASSED QA] Bug 17024: Fix XSS in tools/viewlog.pl Test plan: Hit /tools/viewlog.pl?do_it=1&modules=CATALOGUING&action=MODIFY&object=<script>alert("XSS")</script> => Without this patch you will see the alert => With this patch, no more alert Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Pushed to Master - Should be in the November 2016 release. Thanks!
Pushed in 16.05. Will be in 16.05.03.
Doesn't apply to 3.20.x
Patches pushed to 3.22.x, will be in 3.22.10