diff options
| author |   mkanat%bugzilla.org <> | 2007-02-03 05:42:00 +0000 |
|---|---|---|
| committer | mkanat%bugzilla.org <> | 2007-02-03 05:42:00 +0000 |
| commit | 2cd9b2b1541cf14e0d16424e9966e8cb08d1822c (patch) | |
| tree | 742dda5857f3f2241714113bd8427f4b06227dce | |
| parent | Bug 368654: Release Notes for Bugzilla 2.20.4 (diff) | |
| download | bugzilla-2cd9b2b1541cf14e0d16424e9966e8cb08d1822c.tar.gz bugzilla-2cd9b2b1541cf14e0d16424e9966e8cb08d1822c.tar.bz2 bugzilla-2cd9b2b1541cf14e0d16424e9966e8cb08d1822c.zip | |
Bug 367674: [SECURITY] XSS when reading Atom feeds due to unescaped HTML
Patch By Frédéric Buclin <LpSolit@gmail.com> r=bkor, a=mkanat
| -rw-r--r-- | template/en/default/list/list.atom.tmpl | 24 |
1 files changed, 12 insertions, 12 deletions
diff --git a/template/en/default/list/list.atom.tmpl b/template/en/default/list/list.atom.tmpl index 5e1570811..d3ce06391 100644 --- a/template/en/default/list/list.atom.tmpl +++ b/template/en/default/list/list.atom.tmpl @@ -62,23 +62,23 @@ <tr> <th>Field</th><th>Value</th> </tr><tr> - <td>[% columns.opendate.title FILTER none %]</td> - <td>[% bug.opendate FILTER none %]</td> + <td>[% columns.opendate.title FILTER html %]</td> + <td>[% bug.opendate FILTER html %]</td> </tr><tr> - <td>[% columns.assigned_to_realname.title FILTER none %]</td> - <td>[% bug.assigned_to_realname FILTER none %]</td> + <td>[% columns.assigned_to_realname.title FILTER html %]</td> + <td>[% bug.assigned_to_realname FILTER html %]</td> </tr><tr> - <td>[% columns.priority.title FILTER none %]</td> - <td>[% bug.priority FILTER none %]</td> + <td>[% columns.priority.title FILTER html %]</td> + <td>[% bug.priority FILTER html %]</td> </tr><tr> - <td>[% columns.bug_severity.title FILTER none %] </td> - <td>[% bug.bug_severity FILTER none %]</td> + <td>[% columns.bug_severity.title FILTER html %] </td> + <td>[% bug.bug_severity FILTER html %]</td> </tr><tr> - <td>[% columns.bug_status.title FILTER none %]</td> - <td>[% bug.bug_status FILTER none %]</td> + <td>[% columns.bug_status.title FILTER html %]</td> + <td>[% bug.bug_status FILTER html %]</td> </tr><tr> - <td>[% columns.changeddate.title FILTER none %]</td> - <td>[% bug.changeddate FILTER none -%]</td> + <td>[% columns.changeddate.title FILTER html %]</td> + <td>[% bug.changeddate FILTER html -%]</td> </tr> </table> [% END %] |