Ticket #1251 (closed defect (bug): fixed)

Opened 7 years ago

Last modified 5 years ago

XSS and HTML injection

Reported by: anonymousbugger Owned by: matt
Priority: normal Milestone: 2.1
Component: Security Version: 2.0.1
Severity: major Keywords: 2nd-opinion dev-feedback
Cc:

Description

 http://security.nnov.ru/Idocument320.html

Change History

comment:1   anonymousbugger — 7 years ago

  • Patch set to No

comment:2   matt — 7 years ago

  • Owner changed from anonymous to matt
  • Status changed from new to closed
  • Resolution changed from 10 to 70

comment:3   anonymousbugger — 7 years ago

  • Status changed from closed to assigned
  • Resolution changed from 70 to 30

If it's no issue then please take care of  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1102 and  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=304468

comment:5   ryan — 7 years ago

Debian maintainer contacted.

comment:6   markjaquith — 6 years ago

  • Keywords bg|2nd-opinion bg|dev-feedback added
  • Version set to 2.0.1

Are we going to address this? Maybe we should be filtering the title through KSES except for people with unfiltered_html capability.

comment:7   deko — 6 years ago

Is kses really the best solution? I've been using SafeHTML with WorpPress since my first wp 2.0 installation. I suggest SafeHTML be given consideration as a replacement for kses -  http://pixel-apes.com/safehtml/

comment:8   Nazgul — 5 years ago

  • Keywords 2nd-opinion dev-feedback added; bg|2nd-opinion bg|dev-feedback removed
  • Milestone set to 2.1

comment:9   markjaquith — 5 years ago

  • Status changed from assigned to closed
  • Resolution set to fixed

#2896 (and maybe others)

Note: See TracTickets for help on using tickets.