Task #69062: Properly escape all form attributes in SetupModuleController - TYPO3 Core - TYPO3 Forge

Actions

Copy link

Task #69062

closed

Properly escape all form attributes in SetupModuleController

Added by Frans Saris over 9 years ago. Updated about 6 years ago.

Status:

Closed

Priority:

Should have

Assignee:

Stefan Neufeind

Category:

Target version:

Start date:

2015-08-14

Due date:

% Done:

100%

Estimated time:

TYPO3 Version:

PHP Version:

Tags:

Complexity:

Sprint Focus:

On Location Sprint

Description

Some form tag attributes are directly fetched from configuration without being escaped by htmlspecialchars().

For instance:

            $class = $config['class'];

            if ($type !== 'check') {
                $class .= ' form-control';
            }

            $style = $config['style'];
            if ($class) {
                $more .= ' class="' . $class . '"';
            }

...

            $html = '<input id="field_' . $fieldName . '" 
                type="' . $type . '" 
                name="data' . $dataAdd . '[' . $fieldName . ']" ' .
                $noAutocomplete .
                'value="' . htmlspecialchars($value) . '" ' .
                $more .
            ' />';

See also: https://review.typo3.org/#/c/41780/13/typo3/sysext/setup/Classes/Controller/SetupModuleController.php

We need to make sure all added attributes are properly escaped.

Actions

Copy link

Updated by Frans Saris over 9 years ago

Description updated (diff)

Actions

Copy link

Updated by Gerrit Code Review over 9 years ago

Status changed from New to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/42643

Actions

Copy link

Updated by Gerrit Code Review about 9 years ago

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/42643

Actions

Copy link

Updated by Gerrit Code Review about 9 years ago

Patch set 3 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/42643

Actions

Copy link

Updated by Markus Sommer about 9 years ago

Assignee set to Stefan Neufeind

Actions

Copy link

Updated by Gerrit Code Review about 9 years ago

Patch set 4 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/42643

Actions

Copy link

Updated by Gerrit Code Review about 9 years ago

Patch set 5 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/42643

Actions

Copy link

Updated by Gerrit Code Review over 8 years ago

Patch set 6 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/42643

Actions

Copy link

Updated by Gerrit Code Review over 8 years ago

Patch set 7 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/42643

Actions

Copy link

#10

Updated by Gerrit Code Review over 8 years ago

Patch set 8 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/42643

Actions

Copy link

#11

Updated by Gerrit Code Review over 8 years ago

Patch set 9 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/42643

Actions

Copy link

#12

Updated by Gerrit Code Review over 8 years ago

Patch set 10 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/42643

Actions

Copy link

#13

Updated by Gerrit Code Review over 8 years ago

Patch set 1 for branch TYPO3_7-6 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/47181

Actions

Copy link

#14

Updated by Stefan Neufeind over 8 years ago

Status changed from Under Review to Resolved
% Done changed from 0 to 100

Applied in changeset 367c18481f3b2014791a0b7d9c657e6890973bf9.

Actions

Copy link

#15

Updated by Gerrit Code Review about 8 years ago

Status changed from Resolved to Under Review

Patch set 2 for branch TYPO3_7-6 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/47181

Actions

Copy link

#16