Bug #33651: closing textarea tag on html element in backend closes the textarea itself. - TYPO3 Core - TYPO3 Forge

Custom queries

Accessibility
Easy tasks
Forge Triage
JavaScript issues
JavaScript Issues (w/o Epics/Stories)
My open issues
No feedback within 90 days
Open Bugs
Open issues of 10
Recently modified
Regressions
Stabilization Issues
Usability or UX

Actions

Copy link

Bug #33651

closed

closing textarea tag on html element in backend closes the textarea itself.

Added by Martin Braun almost 13 years ago. Updated about 6 years ago.

Status:

Closed

Priority:

Must have

Assignee:

Category:

Backend API

Target version:

Start date:

2012-02-03

Due date:

% Done:

100%

Estimated time:

TYPO3 Version:

4.6

PHP Version:

5.3

Tags:

Complexity:

Is Regression:

Sprint Focus:

Description

by adding html content in the backend (html element) that contains "</textarea>", the save will be done.
however, on trying to reload/edit the html element in the backend the "</textarea>" (that is apart of own user/admin content) actually closes the textarea of the backend form itself.

the content will be cut off in the backend editor.

Files

Bildschirmfoto_2012-05-22_um_20.42.51.png (49.4 KB) Bildschirmfoto_2012-05-22_um_20.42.51.png

Boris Hinzer, 2012-05-22 20:44

Related issues 2 (0 open — 2 closed)

Has duplicate TYPO3 Core - Bug #46707: Bad HTML parsing

Closed

2013-03-27

Actions

Has duplicate TYPO3 Core - Bug #33272: Persistent XSS in HTML content element through t3editor

Closed

2012-01-17

Actions

Issue # Delay: days Cancel

History
Notes
Property changes
Associated revisions

Actions

Copy link

Updated by Boris Hinzer over 12 years ago

File Bildschirmfoto_2012-05-22_um_20.42.51.png Bildschirmfoto_2012-05-22_um_20.42.51.png added
Assignee set to Helmut Hummel

Same bug still exists in TYPO3 4.7 and ist IMHO a major risk. Additionally, the closing </textarea> can be used to manipulate the TYPO3 backend and also include foreign code using iframes. Please take a look at the attached screenshot.

Here goes the code if want to reproduce this issue:

<form onsubmit="" method="post" action="http://www.web-vision.de/">
  <input type="hidden" value="true" name="bulk">
      <input type="hidden" value="1" name="register">
       <input type="hidden" value="14" name="domain_cat">
    Domain: <textarea  name="sld"></textarea>
    <h1>Now I can manipulate the TYPO3 Backend</h1>
    <iframe src="/robots.txt" style="width:200px; height:200px;"></iframe>
  <input type="checkbox"  value="HERE GOES MY CONTENT"/>
  <input type="submit"  value="SUBMIT"/>

Also this breaks the frontend output of the website.

Actions

Copy link

Updated by Helmut Hummel over 12 years ago

Assignee deleted (~~Helmut Hummel~~)

Boris Hinzer wrote:

Same bug still exists in TYPO3 4.7 and ist IMHO a major risk.

If you allow someone to use the HTML element, you must trust that person, this bug present or not. I could put arbitrary JavaScript in that element, which is then rendered in the frontend. With that I could also do everything in case a logged in user visits that page.

So yes, this bug needs to be fixed, but it does not add additional risks to a TYPO3 installation.

Actions

Copy link

Updated by PRISMA Computer about 12 years ago

This bug is very very bad and should be fixed in 4.7. No more HTML with textarea-element is possible. Typo3 saves the right code one time. But it displays a destroyed version. So, if you save again, the HTML code is broken.

We've chosen 4.7 because it's LTS. We had better taken 4.5 from Ubuntu-repos... But here's a hint for everybody having the same problem. Just add the textarea-element via the template with a little bit javascript and a <div id="placeholder"></div> container:

page.headerData.31 = TEXT
page.headerData.31.value (
<script type="text/javascript">
function AddTextArea() {
var area = document.createElement('textarea');
element = document.getElementById('placeholder').appendChild(area);
element.setAttribute('name', 'comment');
element.setAttribute('cols', '40');
element.setAttribute('rows', '10');
element.setAttribute('wrap', 'virtual');
}
</script>
)
page.bodyTag = <body onload="AddTextArea();">