Unencoded strings included in viewacl javascript

Bug #817342 reported by Richard Mansfield on 2011-07-28
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Mahara
Medium
Richard Mansfield
1.3
Medium
Richard Mansfield
1.4
Medium
Richard Mansfield

Bug Description

The viewacl template has javascript which includes strings directly from the language pack in single quotes instead of json encoded. Strings containing single quotes will result in syntax errors and will stop the js from executing.

I'll mark this as "security" till I've had a chance to discuss it with the others, but it's only exploitable by language pack maintainers, so it's probably better as public.

Changed in mahara:
status: New → Confirmed
importance: Undecided → Medium
assignee: nobody → Richard Mansfield (richard-mansfield)
Ruslan Kabalin (rkabalin) wrote :

Well spotted, Richard. I do not think it is really a security issue, though it would be good to apply it to 1.3/1.4 stable as well.

Okay, I'll mark it as public & submit to gerrit.

Changed in mahara:
importance: Medium → High
security vulnerability: yes → no
visibility: private → public
Changed in mahara:
milestone: none → 1.5.0
Mahara Bot (dev-mahara) wrote :

Reviewed: https://reviews.mahara.org/574
Committed: http://gitorious.org/mahara/mahara/commit/65d78d5c70329ff494949c94bb44999f6aef22c5
Submitter: Richard Mansfield (<email address hidden>)
Branch: 1.4_STABLE

commit 65d78d5c70329ff494949c94bb44999f6aef22c5
Author: Richard Mansfield <email address hidden>
Date: Wed Aug 10 09:51:50 2011 +1200

    Json-encode strings included in viewacl javascript (bug #817342)

    Adds a new dwoo function to json-encode strings for inclusion in
    template javascript, and uses the function in the viewacl template.

    Change-Id: I47e22883c494d0c90fa7075231a840e11d5b6531
    Signed-off-by: Richard Mansfield <email address hidden>

Reviewed: https://reviews.mahara.org/575
Committed: http://gitorious.org/mahara/mahara/commit/b3506a4a7dc735f7fd4fa18c538921fce3ed43e1
Submitter: Richard Mansfield (<email address hidden>)
Branch: 1.3_STABLE

commit b3506a4a7dc735f7fd4fa18c538921fce3ed43e1
Author: Richard Mansfield <email address hidden>
Date: Wed Aug 10 10:35:52 2011 +1200

    Json-encode strings included in viewacl javascript (bug #817342)

    Adds a new dwoo function to json-encode strings for inclusion in
    template javascript, and uses the function in the viewacl template.

    Change-Id: I67af2dc10a975c0c71609106a0251e8ab8e8d7b6
    Signed-off-by: Richard Mansfield <email address hidden>

Mahara Bot (dev-mahara) wrote :

Reviewed: https://reviews.mahara.org/533
Committed: http://gitorious.org/mahara/mahara/commit/1eb96a3dcc997260f5d5bbf1157101f82f65ff75
Submitter: Francois Marier (<email address hidden>)
Branch: master

commit 1eb96a3dcc997260f5d5bbf1157101f82f65ff75
Author: Richard Mansfield <email address hidden>
Date: Fri Jul 29 11:10:36 2011 +1200

    Json-encode strings included in viewacl javascript (bug #817342)

    Adds a new dwoo function to json-encode strings for inclusion in
    template javascript, and uses the function in the viewacl template.

    Change-Id: Ie632061fe94a2adc2943a3d830695a44650847af
    Signed-off-by: Richard Mansfield <email address hidden>

Changed in mahara:
status: Confirmed → Fix Committed
Changed in mahara:
status: Fix Committed → Fix Released
milestone: 1.5.0 → none
Changed in mahara:
importance: High → Medium
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Patches