Bug #28825: Using an apostrophe in the Workspace Name causes quite blank backend - TYPO3 Core - TYPO3 Forge

Custom queries

12 LTS
Accessibility
Dashboard issues
Easy tasks
Extbase Issues
FAL Issues
FAL Sprint 2023
Hierarchical Issues
Issues reported for v11
JavaScript issues
JavaScript Issues (w/o Epics/Stories)
Most wanted Bugfixes
Most wanted Features
My open issues
New & Unassigned
No feedback within 90 days
Open Bugs
Open issues of 10
Page Tree Regressions after 2020-07-28
Recently modified
Regressions
Stabilization Issues
Usability or UX

Actions

Copy link

Bug #28825

closed

Using an apostrophe in the Workspace Name causes quite blank backend

Added by Ingo Pfennigstorf almost 13 years ago. Updated over 5 years ago.

Status:

Closed

Priority:

Should have

Assignee:

Marco Bresch

Category:

Workspaces

Target version:

Start date:

2011-08-08

Due date:

% Done:

100%

Estimated time:

TYPO3 Version:

4.5

PHP Version:

5.3

Tags:

Complexity:

Is Regression:

Sprint Focus:

Description

When you add a workspace with a name like "Sonja's Workspace" and try to switch to it only the upper menu bar in the backend will show up, the other parts are left blank.
Though it might be clear for information scientists, editors do use names like this.
The error seemed to appear in typo3/js/modulemenu.js - so i'm not really sure whether it's a core issue or belongs to the workspace team.

History
Notes
Property changes
Associated revisions

Actions

Copy link

Updated by Christian Kuhn almost 13 years ago

Project changed from 624 to 1716
Category deleted (~~Bugs~~)

Actions

Copy link

Updated by Christian Kuhn almost 13 years ago

This sounds like a security issue, we have to check it.

Actions

Copy link

Updated by Oliver Hader almost 13 years ago

Confirmed as XSS

When switching to the accordant workspace, next to the user's name the title of the active workspace is shown - without sanitation...
Classical XSS, however sys_workspaces records can only be edited on root level - so only admins can introduce the XSS...

Actions

Copy link

Updated by Oliver Hader almost 13 years ago

Status changed from New to Accepted

Actions

Copy link

Updated by Steffen Gebert almost 13 years ago

Wasn't the decision of the security team that issues, which can only be introduced by admins are not treated as security issues? So I think we can handle this one publicly (however, have no problem, if not).

Actions

Copy link