Bug #71698: Link fields accept inline javascript code - TYPO3 Core - TYPO3 Forge

Actions

Copy link

Bug #71698

closed

Link fields accept inline javascript code

Added by Oliver Hader over 8 years ago. Updated over 5 years ago.

Status:

Closed

Priority:

Should have

Assignee:

Oliver Hader

Category:

Target version:

Start date:

2015-11-19

Due date:

% Done:

100%

Estimated time:

TYPO3 Version:

6.2

PHP Version:

5.5

Tags:

Complexity:

Is Regression:

Sprint Focus:

Description

javascript:alert(1) can be submitted for every link field and will be rendered in the frontend passed through typolink. To circumvent that, the URI scheme and prefix "javascript:" will be disallowed per default. The extension "javascript_handler" allows however to bring back that insecure behavior since some installations might rely on it.

Files

javascript_handler_1.0.0.zip (2.27 KB) javascript_handler_1.0.0.zip

Nicole Cordes, 2015-12-15 12:09

Actions

Copy link

Updated by Oliver Hader over 8 years ago

File javascript_handler.zip added

Actions

Copy link

Updated by Gerrit Code Review over 8 years ago

Status changed from New to Under Review

Patch set 1 for branch master of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/44803

Actions

Copy link

Updated by Gerrit Code Review over 8 years ago

Patch set 2 for branch master of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/44803

Actions

Copy link

Updated by Gerrit Code Review over 8 years ago

Patch set 1 for branch TYPO3_6-2 of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/44804

Actions

Copy link

Updated by Gerrit Code Review over 8 years ago

Patch set 3 for branch master of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/44803

Actions

Copy link

Updated by Gerrit Code Review over 8 years ago

Patch set 2 for branch TYPO3_6-2 of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/44804

Actions

Copy link

Updated by Georg Ringer over 8 years ago

Status changed from Under Review to Resolved

merged in release branch

Actions

Copy link

Updated by Gerrit Code Review over 8 years ago

Status changed from Resolved to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/44876

Actions

Copy link

Updated by Georg Ringer over 8 years ago

Status changed from Under Review to Resolved

merged in release branch

Actions

Copy link

#10

Updated by Gerrit Code Review over 8 years ago

Status changed from Resolved to Under Review

Patch set 1 for branch TYPO3_6-2 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/45265

Actions

Copy link

#11

Updated by Oliver Hader over 8 years ago

Status changed from Under Review to Resolved
% Done changed from 0 to 100

Applied in changeset typo3cms-core:25a1473907f0f4b2bb0147c661981940c57a4555.

Actions

Copy link

#12

Updated by Gerrit Code Review over 8 years ago

Status changed from Resolved to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/45277

Actions

Copy link

#13