Re: [phpBT-dev] Security issue

[Ben C. <php...@be...>]

Greater than and less than signs should be translated to their html
entity equivalents on output.  If this isn't happening in the bug
comments or elsewhere then it should be fixed.

On Tue, May 07, 2002 at 02:31:37PM -0000, Jirka Pech wrote:
> > My goal is to have it out by the end of the week.  When it is released
> I'll
> > tag it so that we can branch it properly for patches vs. new
> developments.
> > Thanks for asking!
> 
> There may be a problem with special characters like "greater than" ">" and
> "lesser than" "<". You probably know, what I'm talking about. When you add
> a comment to bug with javascript in proper tag, it's executed on client
> side. When you submit something with unclosed "lesser than", the tag will
> begin and one tag after it will be lost.
> 
> If you want it to be repaired/fixed (sorry for my english) before release
> 0.8.2, please, tell me, because it's security related and I'm too young to
> be sure if it is clever to release software with holes.
> 
> I'm planning one cosmetic change, before release 0.8.2. I'll do it later
> today. Then I'll stop changing anything until release 0.8.2.
> 
> Jirka
> 
> _______________________________________________________________
> 
> Have big pipes? SourceForge.net is looking for download mirrors. We supply
> the hardware. You get the recognition. Email Us: ban...@so...
> _______________________________________________
> phpbt-dev mailing list
> php...@li...
> https://lists.sourceforge.net/lists/listinfo/phpbt-dev