Bug #18562

Adding <script> Tag in pagetitle field

Added by Guido S. over 12 years ago. Updated over 10 years ago.

Status:
Closed
Priority:
Should have
Category:
-
Target version:
-
Start date:
2008-04-04
Due date:
% Done:

0%

Estimated time:
TYPO3 Version:
4.1
PHP Version:
5.0
Tags:
Complexity:
Is Regression:
Sprint Focus:

Description

If i add a new page., I just tried to include HTML Code in field "pagetitle". TYPO3 Backend accept this and the Frontend render this HTML Code:

I think HTML is okay, but the <script> Tag is maybe to insecure?

I add this code:
<html><script>alert("Test")</script></html>
(issue imported from #M8019)


Files

8019_admPanel_htmlspecialchars.diff (2.15 KB) 8019_admPanel_htmlspecialchars.diff Administrator Admin, 2008-04-04 13:33
#1

Updated by Steffen Kamper over 12 years ago

This is a Admin-only function, why should it be insecure?

#2

Updated by Guido S. over 12 years ago

I think in worst case. Redakteur uses this function to readout some user cookies or something else.

But i think my issue could be delete :-)

#3

Updated by Steffen Kamper over 12 years ago

editors are not allowed to edit TS, only admins.

I close this issue.

#4

Updated by Steffen Kamper over 12 years ago

i tested it also and you are right, the JS is executed in FE, so imho there is a missing htmlspecialchars for FE

#5

Updated by Guido S. over 12 years ago

Okay.

As advised: Minor :)

#6

Updated by Steffen Kamper over 12 years ago

once again - the execution is not in Page but in Admin Panel. Is this the place where you have it also?

so page title in <title> is with htmlspecialchars, in AdminPanel not

#7

Updated by Guido S. over 12 years ago

I found it in an another way. I change pagetitle in Admin, and i think all is fine. I found no JS Popups in Admin. Where have you found this?

We see the JS Popup in the frontend if TYPO3 generate the menu (special = directory)

Edit:
<title> use htmlsepcialchars(), thats right

#8

Updated by Christian Kuhn over 11 years ago

Committed to 4.2 by Ingmar on 2008-04-20

Also available in: Atom PDF