Opened 8 years ago

Closed 7 years ago

#1251 closed defect (bug) (fixed)

XSS and HTML injection

Reported by: anonymousbugger Owned by: matt
Priority: normal Milestone: 2.1
Component: Security Version: 2.0.1
Severity: major Keywords: 2nd-opinion dev-feedback
Cc:

Description

​http://security.nnov.ru/Idocument320.html

Change History (9)

comment:1   anonymousbugger — 8 years ago

  • Patch set to No

comment:2   matt — 8 years ago

  • Owner changed from anonymous to matt
  • Resolution changed from 10 to 70
  • Status changed from new to closed

comment:3   anonymousbugger — 8 years ago

  • Resolution changed from 70 to 30
  • Status changed from closed to assigned

If it's no issue then please take care of ​http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1102 and ​http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=304468

comment:5   ryan — 8 years ago

Debian maintainer contacted.

comment:6   markjaquith — 7 years ago

  • Keywords bg|2nd-opinion bg|dev-feedback added
  • Version set to 2.0.1

Are we going to address this? Maybe we should be filtering the title through KSES except for people with unfiltered_html capability.

comment:7   deko — 7 years ago

Is kses really the best solution? I've been using SafeHTML with WorpPress since my first wp 2.0 installation. I suggest SafeHTML be given consideration as a replacement for kses - ​http://pixel-apes.com/safehtml/

comment:8   Nazgul — 7 years ago

  • Keywords 2nd-opinion dev-feedback added; bg|2nd-opinion bg|dev-feedback removed
  • Milestone set to 2.1

comment:9   markjaquith — 7 years ago

  • Resolution set to fixed
  • Status changed from assigned to closed

#2896 (and maybe others)

Note: See TracTickets for help on using tickets.