Saturday, 2009-12-05

../irclogs/#mantishelp.2009-12-05.log
--- scribe started ---00:00
--- scribe started ---11:56
paulr_dhx_m13:41
paulr_hi13:41
paulr_:)13:41
paulr_i've got some issues for you :P13:41
dhx_mpaulr_: hi! :)13:42
paulr_hmm13:42
* paulr_ watches php crash13:42
dhx_mand now it's my fault hey? :p13:43
paulr_nah13:43
paulr_right13:43
paulr_xss issues13:43
dhx_myep13:43
dhx_mfrom the other day when you weren't here:13:44
dhx_mdhx_m> "user_get_name should return a relatively safe username imo"... it shouldn't, as user_get_name isn't going to always be used for HTML output... we have email output, twitter output, SOAP output, etc13:44
paulr_wow13:44
paulr_just wow13:44
paulr_;)13:44
dhx_mto answer a concern from a few days ago :p13:44
paulr_i was more meaning13:45
paulr_a username should be plain characters13:45
paulr_but ok13:45
paulr_ok :(13:45
paulr_let me pm you a xss url :P13:45
dhx_mnah we should allow UTF-8 characters13:45
dhx_moh you found more? :o13:45
paulr_no13:45
paulr_old one13:45
dhx_myou may want Russian usernames, etc13:45
paulr_which as you seem to want to fix them :P13:45
CIA-21Mantisbt: hickseydr * r3363f9076326 /permalink_page.php: Fix #11260: Attribute injection/XSS in permalink_page.php14:11
CIA-21Mantisbt: hickseydr master-1.2.x * r1740b99c46c6 /permalink_page.php: Fix #11260: Attribute injection/XSS in permalink_page.php14:11
nuclear_eclipsebtw dhx_m, you should be using string_attribute() instead of string_display_line() when it's going into a attribute field of an HTML tag...14:45
dhx_mnuclear_eclipse: I thought about that, but string_attribute doesn't handle new lines?14:46
dhx_mnuclear_eclipse: btw thanks for fixing the anonymous login bug :D14:46
nuclear_eclipseit shouldn't have any reason to for a username?14:46
dhx_mright... but I was assuming the worst case data being provided to the HTML output layer14:47
nuclear_eclipseanyways, newlines in an HTML attribute is a non-issue IMO14:47
nuclear_eclipsehowever, string_display will not escape quotes, and you absolutely need that for something going into an attribute field14:48
dhx_mI just thought that someone could potentially use new-lines to trick users into thinking there are two links/buttons instead of one14:48
dhx_mit will escape double quotes (from my tests)14:49
nuclear_eclipseoh?14:49
nuclear_eclipsebtw, a newline in an href ends the url afaik14:49
nuclear_eclipseand you could do echo '<a href="', string_attribute( $url ), '">', string_display_line( $url ), '</a>'14:50
dhx_mguess so14:50
dhx_m$t_string = string_html_specialchars( $t_string );14:50
nuclear_eclipsewhich IMO would be more semantically correct14:50
dhx_mfrom MantisCoreFormatting.php14:50
dhx_moh well, we'll be fixing all of this mess with the move to templating14:51
dhx_mif that ever happens14:51
dhx_mI know PHPTAL handles string sanitising for you (AFAIK)14:51
dhx_manyway, gtg for now14:55
dhx_mwill be around later14:55
dhx_mcya14:55
paulr_WOW16:14
* paulr_ smashes nuclear_eclipse with a brick16:14
beejeebusdoes mantis support mail routing?19:52
beejeebusreplying to a ticket via an email?19:52
moto-moiNot replying, but it can email the owner of the ticket after the ticket changes19:53
moto-moiBut I don't think that is what you mean?19:53
moto-moidon't you mean something like OTRS?19:54
beejeebusmoto-moi: right, i mean, an email is generated for a ticket, and the viewer of the email can reply to ticket-<id>@example.com, and it is automatically associated with ticket <id>19:54
beejeebuslike eventum or RT etc19:54
moto-moiNo, it can't do that :)19:54
beejeebusmoto-moi: how pluggable is it? can that be written as a plugin?19:55
moto-moiI have never looked into that, so I wouldn't know, sorry :)19:55
beejeebusmoto-moi: ok, thanks19:55
CIA-21Mantisbt: s.mazeland * r964915c9db27 / (5 files in 2 dirs): Localisation updates from translatewiki.net (2009-12-05)20:19
paulr_nuclear_eclipse: oi20:26
paulr_dhx_m: sigh22:22

Generated by irclog2html.py