| ../irclogs/#mantishelp.2009-12-01.log | ||
| --- scribe started --- | 00:00 | |
| CIA-21 | Mantisbt: hickseydr * r70b5022f556c / (4 files in 2 dirs): Fix #11229: Fix tagging XSS scripting vulnerabilities | 01:02 |
|---|---|---|
| CIA-21 | Mantisbt: hickseydr master-1.2.x * rd36359cf13c4 / (4 files in 2 dirs): Fix #11229: Fix tagging XSS scripting vulnerabilities | 01:03 |
| CIA-21 | Mantisbt: hickseydr master-1.1.x * rc6f356da55f3 / (4 files in 2 dirs): Fix #11229: Fix tagging XSS scripting vulnerabilities | 01:31 |
| CIA-21 | Mantisbt: hickseydr * rb1bc26eb0786 /manage_tags_page.php: Fix #11235: XSS on manage_tags_page.php with user Real Name field | 05:56 |
| CIA-21 | Mantisbt: hickseydr * r810ae0795530 /core/summary_api.php: Fix #11232: XSS on summary_page.php with user Real Name field | 05:56 |
| CIA-21 | Mantisbt: hickseydr * ra49cc3cefbab /adm_config_report.php: Fix #11233: XSS on adm_config_report.php with user Real Name field | 05:56 |
| CIA-21 | Mantisbt: hickseydr * rbb920bf5b45b /core/filter_api.php: Fix #11236: XSS on view_all_bug_page.php with user Real Name field | 05:56 |
| CIA-21 | Mantisbt: hickseydr * r01270e48f13e /tag_view_page.php: Fix #11237: XSS on tag_view_page.php with user Real Name field | 05:56 |
| CIA-21 | Mantisbt: hickseydr * r93f36d260294 /tag_update_page.php: Fix #11238: XSS on tag_update_page.php with user Real Name field | 05:56 |
| CIA-21 | Mantisbt: hickseydr master-1.2.x * r42e3640a6b79 /manage_tags_page.php: Fix #11235: XSS on manage_tags_page.php with user Real Name field | 06:02 |
| CIA-21 | Mantisbt: hickseydr master-1.2.x * r92561bce73a6 /adm_config_report.php: Fix #11233: XSS on adm_config_report.php with user Real Name field | 06:02 |
| CIA-21 | Mantisbt: hickseydr master-1.2.x * r8491dbdf5dff /tag_view_page.php: Fix #11237: XSS on tag_view_page.php with user Real Name field | 06:02 |
| CIA-21 | Mantisbt: hickseydr master-1.2.x * rc23edbfb97b1 /core/summary_api.php: Fix #11232: XSS on summary_page.php with user Real Name field | 06:02 |
| CIA-21 | Mantisbt: hickseydr master-1.2.x * r4cb58c70b8b3 /core/filter_api.php: Fix #11236: XSS on view_all_bug_page.php with user Real Name field | 06:02 |
| CIA-21 | Mantisbt: hickseydr master-1.2.x * rb1f59933bdd8 /tag_update_page.php: Fix #11238: XSS on tag_update_page.php with user Real Name field | 06:02 |
| CIA-21 | Mantisbt: hickseydr * r15b0752ae834 /view_user_page.php: Fix #11239: XSS on view_user_page.php with user Real Name field | 06:11 |
| CIA-21 | Mantisbt: hickseydr master-1.2.x * r67ed4313c071 /view_user_page.php: Fix #11239: XSS on view_user_page.php with user Real Name field | 06:11 |
| CIA-21 | Mantisbt: hickseydr * r71ade607240f /bug_revision_view_page.php: Fix #11240: XSS on bug_revision_view_page.php with user Real Name field | 06:18 |
| CIA-21 | Mantisbt: hickseydr master-1.2.x * r194099694d91 /bug_revision_view_page.php: Fix #11240: XSS on bug_revision_view_page.php with user Real Name field | 06:18 |
| CIA-21 | Mantisbt: hickseydr * r0aeb2ea2895d /manage_proj_page.php: Fix #11241: XSS on manage_proj_page.php with user Real Name field | 06:28 |
| CIA-21 | Mantisbt: hickseydr master-1.2.x * ree7ee6d4f699 /manage_proj_page.php: Fix #11241: XSS on manage_proj_page.php with user Real Name field | 06:28 |
| CIA-21 | Mantisbt: hickseydr * ra77662d5823e /manage_proj_edit_page.php: Fix #11242: XSS on manage_proj_edit_page.php with user Real Name field | 06:35 |
| CIA-21 | Mantisbt: hickseydr master-1.2.x * r868c1d6cbddc /manage_proj_edit_page.php: Fix #11242: XSS on manage_proj_edit_page.php with user Real Name field | 06:35 |
| CIA-21 | Mantisbt: hickseydr * r0789144e6059 /account_update.php: Fix #11234: Validate user name and email on account_page.php | 06:44 |
| CIA-21 | Mantisbt: hickseydr master-1.2.x * r9c0f46d6e40f /account_update.php: Fix #11234: Validate user name and email on account_page.php | 06:44 |
| CIA-21 | Mantisbt: hickseydr * rbe4dbbf81019 /core/ (columns_api.php custom_function_api.php): Fix #11243: XSS on view_all_bug_page.php due to bad sanitising defaults | 07:31 |
| CIA-21 | Mantisbt: hickseydr master-1.2.x * rb66d1b040106 /core/ (columns_api.php custom_function_api.php): Fix #11243: XSS on view_all_bug_page.php due to bad sanitising defaults | 07:31 |
| CIA-21 | Mantisbt: hickseydr * r96ab63b6323f / (3 files in 2 dirs): Fix #11244: XSS on change log and roadmap pages (project names) | 07:47 |
| CIA-21 | Mantisbt: hickseydr master-1.2.x * rdf0a5af45f4a / (3 files in 2 dirs): Fix #11244: XSS on change log and roadmap pages (project names) | 07:47 |
| CIA-21 | Mantisbt: hickseydr master-1.2.x * rb4b275a5ea3b /core/columns_api.php: Fix #11245: Sanitise project name in print_column_category_id() | 08:25 |
| CIA-21 | Mantisbt: hickseydr * r141cbe6e8667 /core/columns_api.php: Fix #11245: Sanitise project name in print_column_category_id() | 08:25 |
| CIA-21 | Mantisbt: hickseydr * r98f63cf5d7f1 /core/print_api.php: Fix #11246: XSS bug in category dropdown selector | 09:34 |
| CIA-21 | Mantisbt: hickseydr master-1.2.x * rccae795a7cc2 /core/print_api.php: Fix #11246: XSS bug in category dropdown selector | 09:34 |
| CIA-21 | Mantisbt: hickseydr * r403cd6c13195 / (adm_config_report.php core/print_api.php): Fix #11247: XSS in various management pages (project names) | 09:50 |
| CIA-21 | Mantisbt: hickseydr master-1.2.x * rd55a7f24e72e / (adm_config_report.php core/print_api.php): Fix #11247: XSS in various management pages (project names) | 09:50 |
| dhx_m | should be rock solid now :D | 09:52 |
| kirillka | dhx_m: hi | 10:13 |
| dhx_m | kirillka: hi | 10:13 |
| kirillka | I see you don't sleep :) Only works | 10:13 |
| dhx_m | lol | 10:13 |
| CIA-21 | Mantisbt: hickseydr master-1.2.x * r2515b3655fb0 /images/rss.png: Fix #11223: RSS image has execute permission bits set | 11:46 |
| CIA-21 | Mantisbt: hickseydr * re95b87a3df62 /images/rss.png: Fix #11223: RSS image has execute permission bits set | 11:46 |
| paulr_ | lo dhx_m | 11:48 |
| dhx_m | paulr_: hey | 11:48 |
| paulr_ | erm | 11:48 |
| paulr_ | -<?php echo project_get_name( $v_project_id ) ?> | 11:49 |
| paulr_ | +<?php echo string_display_line( project_get_name( $v_project_id ) ) | 11:49 |
| paulr_ | project names shouldn't be an issue? | 11:49 |
| paulr_ | i.e. we dont allow < > etc in them do we? | 11:49 |
| dhx_m | we do | 11:49 |
| paulr_ | w.t.f.? | 11:49 |
| dhx_m | don't ask me :p | 11:49 |
| paulr_ | are you sure? | 11:49 |
| paulr_ | or well | 11:49 |
| paulr_ | nice | 11:49 |
| paulr_ | v. nice | 11:49 |
| paulr_ | so basically | 11:50 |
| paulr_ | :( | 11:50 |
| dhx_m | basically every thing internally within Mantis is hostile | 11:50 |
| dhx_m | s/thing/string | 11:50 |
| dhx_m | and it has to be parsed correctly before being used in an SQL query, REGEX pattern or being output to the user (via HTML, SOAP, CSV, etc) | 11:50 |
| dhx_m | I guess that has the advantage of if an SQL injection attack does happen on a table... someone inserting HTML won't have any impact :) | 11:52 |
| paulr_ | well sql injection we should block | 11:57 |
| paulr_ | xss is another matter | 11:57 |
| paulr_ | but i wasn't aware of xss via project-name | 11:58 |
| paulr_ | so kinda confused | 11:58 |
| paulr_ | (and i've done scan's with various apps e.g. ibm's appscan) | 11:58 |
| dhx_m | those generally only work by passing in arguments to forms | 12:20 |
| dhx_m | and seeing if the resulting page shows those "canaries" | 12:20 |
| dhx_m | whereas I went through and found every text box Mantis has | 12:20 |
| dhx_m | and inserted <script>alert(x);</script> where x is a tracking number I used | 12:21 |
| dhx_m | to differentiate between fields causing problems | 12:21 |
| dhx_m | and then I went through all the Mantis pages I could find | 12:25 |
| dhx_m | clicking every link/button | 12:25 |
| dhx_m | to see if I could find any XSS problems | 12:25 |
| paulr_ | dhx_m: I'm still not convinced :P | 15:03 |
| paulr_ | unless ofc people broke stuff | 15:03 |
| paulr_ | as i've had a pc program that basically does that | 15:03 |
| * nuclear_eclipse blames daryn | 15:03 | |
| paulr_ | tends to do ~100,000 requests to complete a run | 15:03 |
| paulr_ | and in the past, we've been mainly clean | 15:03 |
| paulr_ | nuclear_eclipse: was you aware that project name can have xss? | 15:04 |
| paulr_ | or more can you recall any changes to this | 15:04 |
| nuclear_eclipse | I dunno | 15:04 |
| paulr_ | well | 15:05 |
| * paulr_ not impressed :) | 15:05 | |
| nuclear_eclipse | you rarely are ;) | 15:06 |
| nuclear_eclipse | dhx_m: why are we sanitizing the date format?! | 15:10 |
| paulr_ | :) | 15:11 |
| paulr_ | i've added that to something to patch :P | 15:11 |
| paulr_ | number 21 on the list | 15:11 |
| paulr_ | (of things i've not got around to whinging/fixing since july :((() | 15:11 |
| paulr_ | the reason i'm a bit surprised is | 15:12 |
| paulr_ | i've run my scanners against 1.1 | 15:12 |
| paulr_ | and probably 1.2 from say 9-12 months ago (i'd need to check date) | 15:12 |
| paulr_ | so really, things that need patching should have been introduced in last 12 months | 15:12 |
| paulr_ | I can't really believe we've introduced so many bugs in 12 months ;p | 15:13 |
| daryn | wait...what are you blaming me for? | 15:15 |
| nuclear_eclipse | most of these changes I can understand; I for one didn't think that user_get_name wasn't sanitized because I just copied how it wa used everywhere else -- but sanitizing a date string seems more than unnecessary | 15:15 |
| nuclear_eclipse | daryn: I needed a scapegoat; congratulations :) | 15:16 |
| daryn | ah...well, i haven't committed much of anything in the last twelve months so I think i'm relatively safe | 15:16 |
| heraclide | hello :) | 15:51 |
| heraclide | i don't find out how to have custom fieds depending on category or on other custom fields when reporting a bug ? | 15:52 |
| heraclide | like for example, people get in sys admin projet, wanna report a problem, they have to choose between account problem, rights problem, dns problem | 15:53 |
| heraclide | and depending on what they choose, they have to fill some custom fields ? | 15:53 |
| nuclear_eclipse | heraclide: there's no way to dynamically hide/show custom fields | 15:53 |
| heraclide | doh doh doh :( | 15:53 |
| heraclide | I have to use sub-projects ? | 15:54 |
| nuclear_eclipse | perhaps | 15:54 |
| heraclide | oki doki :) | 15:54 |
| heraclide | thanks :) | 15:54 |
| nuclear_eclipse | heraclide: you could potentially implement what you're wanting with a plugin | 15:55 |
| nuclear_eclipse | but it would require much more effort to implement than creating sub-projects =\ | 15:56 |
| heraclide | yes :( | 15:59 |
| heraclide | and I have not that much time :( | 16:00 |
| heraclide | bonne soiree tlm :) | 18:01 |
| daryn | nuclear_eclipse around? | 18:29 |
| * paulr_ moos | 18:52 | |
| paulr_ | daryn_: what you broken? | 18:52 |
| daryn_ | ? | 18:52 |
| paulr_ | :) | 18:53 |
| daryn_ | my network config sucks | 18:53 |
| nuclear_eclipse | daryn_: here now | 19:11 |
| daryn_ | hi | 19:11 |
| daryn_ | i was wondering about adding jquery plugins to the jquery plugin...that sounds weird | 19:12 |
| nuclear_eclipse | you mean you want some of the plugins for jquery included in the mantis plugin? :P | 19:12 |
| daryn_ | bingo | 19:13 |
| daryn_ | i tried to add but it's not working | 19:13 |
| daryn_ | i added the files and the script tag to the resources output | 19:13 |
| daryn_ | but when the browser tries to load it it is not recognizing the file. | 19:14 |
| nuclear_eclipse | hmm, you have a patch you can lend me? | 19:17 |
| daryn_ | it's sending an xhtml doctype | 19:17 |
| daryn_ | m...sure | 19:17 |
| daryn_ | emailed | 19:23 |
| nuclear_eclipse | I'm not seeing anything in my inbox from you.. | 19:26 |
| daryn_ | hm...i can pastebin it but its over 700 lines | 19:27 |
| daryn_ | just due to the new jquery file | 19:27 |
| nuclear_eclipse | yeah... =\ | 19:28 |
| nuclear_eclipse | can you just paste a diff to the jQuery.php? | 19:28 |
| daryn_ | yeah | 19:28 |
| nuclear_eclipse | nvm | 19:29 |
| daryn_ | ok | 19:29 |
| nuclear_eclipse | just got the email | 19:29 |
| nuclear_eclipse | I think it's the "jquery-ui.min.js | 19:31 |
| nuclear_eclipse | plugin_file.php only accepts filenames with a single period for security reasons | 19:32 |
| daryn_ | if i hardcode the path it works | 19:33 |
| daryn_ | ah... | 19:33 |
| nuclear_eclipse | ie, I didn't want to somehow let a "../.." type of thing slip past | 19:33 |
| daryn_ | let me try that | 19:33 |
| nuclear_eclipse | that sort of vulnerability would be huge | 19:33 |
| daryn_ | yep. wasn't thinking about that | 19:33 |
| nuclear_eclipse | ie, it could allow someone to form a uri that could expose any file that Apache/PHP has access to | 19:34 |
| daryn_ | that did it. thanks | 19:34 |
| nuclear_eclipse | np | 19:34 |
| dhx_m | nuclear_eclipse: I just escaped dates in case they contain some special character such as & | 23:33 |
| dhx_m | nuclear_eclipse: more for consistency than anything else | 23:33 |
| dhx_m | paulr_: those bugs I found have been around for a long time and as I said previously, most scanners wouldn't be able to pick them up | 23:34 |
| dhx_m | paulr_: the reason being that they don't understand how to create new projects, new bugs, etc | 23:34 |
Generated by irclog2html.py