Uploaded image for project: 'JCommune'
  1. JCommune
  2. JC-560

XSS on personal message when you enter more than 1000 characters

VotersWatchers
    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed (View Workflow)
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 0.12
    • Fix Version/s: 0.13
    • Labels:
      None

      Description

      1. Open Messages->New message
      2. Enter following text to the message field:
      <input style="background-position: center center;" class="inputtext" type="text" id="edit_activity_text" name="edit_activity_text" value="« maxlength=»160" onblur="return activity_editor.blur ();" onkeypress="return activity_editor.handle_key_press (event);" />после чего заменить его на следующий: <textarea id="edit_activity_text" name="edit_activity_text" onblur="return activity_editor.blur ();" ></textarea><input style="background-position: center center;" class="inputtext" type="text" id="edit_activity_text" name="edit_activity_text" value="« maxlength=»160" onblur="return activity_editor.blur ();" onkeypress="return activity_editor.handle_key_press (event);" /><input style="background-position: center center;" class="inputtext" type="text" id="edit_activity_text" name="edit_activity_text" value="« maxlength=»160" onblur="return activity_editor.blur ();" onkeypress="return activity_editor.handle_key_press (event);" />после чего заменить его на следующий: там там там там там там тамй<script>alert('Hi')</script>
      3. Click Save or Send button

      actual result: Dialog Box appears with button "OK" and message "Hi"
      expected: error message appeasr with test "should be 2-1000 characters"

        Attachments

          Structure

            Activity

              People

              • Assignee:
                lolkidslol Vladimir Kritskiy
                Reporter:
                lolkidslol Vladimir Kritskiy
              • Votes:
                0 Vote for this issue
                Watchers:
                0 Start watching this issue

                Dates

                • Due:
                  Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 1h
                  1h

                    Structure Helper Panel