Bug #23303

Element-Browser page tree has HSC'ed <span> elements

Added by Lienhart Woitok about 9 years ago. Updated about 9 years ago.

Status:
Closed
Priority:
Should have
Assignee:
Category:
-
Target version:
-
Start date:
2010-07-29
Due date:
% Done:

0%

TYPO3 Version:
4.1
PHP Version:
5.2
Tags:
Complexity:
Is Regression:
Sprint Focus:

Description

See attached screenshot.

The screenshot is taken from the element browser window of an TCE group field and shows the page tree of the element browser.

I also found an & in one page title, so maybe the HSC is done twice?

(issue imported from #M15289)

element-browser-span.png View (24.8 KB) Administrator Admin, 2010-07-29 16:28

0015289.patch View (1.19 KB) Administrator Admin, 2010-07-30 15:13

0015289_v2.patch View (2.5 KB) Administrator Admin, 2010-07-31 16:12


Related issues

Duplicated by TYPO3 Core - Bug #23293: Raw HTML shown in Element Browser's pagetree with options.pageTree.showNavTitle = 1 Closed 2010-07-28

History

#1 Updated by about 9 years ago

I can confirm this one.
Working on that now (TYPO3 Bugday).
Reproducible also in 4.4 and trunk.

Reason is
htmlspecialchars for $title in
typo3/class.browse_links.php
function wrapTitle (l. 426)

introduced in rev 8318

#2 Updated by about 9 years ago

nav_title is htmlspecialchared in class.t3lib_treeview.php, l. 685
$title is hsc'ed in same class l. 683

so no need to do it again

#3 Updated by Oliver Hader about 9 years ago

This issue affects all versions of TYPO3. 4.1-4.4, Trunk

#4 Updated by Oliver Hader about 9 years ago

The attached patch fixes this issue. By analyzing the source code, we can be sure that the title for regular pages (not for files and folders) are escaped by htmlspecialchars() before. Thus, the superfluous HSC go removed. However, this opens another possibility to introduce XSS with domain names (this is currently safe due to the possible double HSC).

#5 Updated by Lienhart Woitok about 9 years ago

The attached patch works fine for me. Thank you.

#6 Updated by Oliver Hader about 9 years ago

Committed to SVN:
  • TYPO3_4-1 (rev. 8466)
  • TYPO3_4-2 (rev. 8467)
  • TYPO3_4-3 (rev. 8468)
  • TYPO3_4-4 (rev. 8469)
  • Trunk (rev. 8470)

#7 Updated by Ingo Renner about 9 years ago

released in
4.1.15
4.2.14
4.3.5
4.4.2

Also available in: Atom PDF