From: Sylvie G. <sgr...@gm...> - 2011-08-25 15:16:23
|
Thx for testing lph. Not working for me in tiki7 and trunk. The page must be an html page On Thu, Aug 25, 2011 at 10:29 AM, Louis-Philippe Huberdeau < lph...@lp...> wrote: > Someone might have fixed this really recently, but I can't reproduce in > trunk. > > I tried with html purifier on/off > With the wiki editor and plugin editor > > I've never seen an <x> anywhere. > > -- > LP > > > On Thu, Aug 25, 2011 at 9:55 AM, Sylvie Greverend <sgr...@gm...>wrote: > >> The page source is >> {tracker trackerId="1" url="Merci"} >> if html purifier is off, the <x> is added when you save the page. >> if html purifier is on , the <x> that was added by the tikifilter in >> lib/setup/editMode.php is cleaned by htmlpurifier in tikilib.php >> update_page..... >> The filter on the url param is url..... >> I have the impression that there are 2 bugs going on >> >> >> On Thu, Aug 25, 2011 at 8:00 AM, Louis-Philippe Huberdeau < >> lph...@lp...> wrote: >> >>> It should not be getting purified as the the parser will handle the >>> possible injections. If it gets purified, it's because no filters are >>> specified or some other strange manipulation is going on. Which edit path >>> leads to <x> being inserted? >>> >>> -- >>> LP >>> >>> >>> On Thu, Aug 25, 2011 at 6:39 AM, Jonny Bradley <jo...@ti...> wrote: >>> >>>> >>>> Yes, i saw that once somewhere Sylvie - in the end i just had to use a >>>> non-html page. >>>> >>>> +1 for changing the parameter (maybe with a check for legacy 'url' >>>> parameters that still work ;) >>>> >>>> jb >>>> >>>> >>>> >>>> >>>> On 25 Aug 2011, at 02:22, Sylvie Greverend wrote: >>>> >>>> > I do not know why exactly (must be an html page at least+...) but >>>> when you use the param url in tracker plugin , it gets xss purify and become >>>> ur<x>l >>>> > (in tiki7 at least). >>>> > What is the best? >>>> > Do we change the param name? >>>> > Do we ...? I do not know in fact? I suppose if url is purified it is >>>> because it is dangerous >>>> > THx >>>> > sylvie >>>> > >>>> > >>>> ------------------------------------------------------------------------------ >>>> > EMC VNX: the world's simplest storage, starting under $10K >>>> > The only unified storage solution that offers unified management >>>> > Up to 160% more powerful than alternatives and 25% more efficient. >>>> > Guaranteed. >>>> http://p.sf.net/sfu/emc-vnx-dev2dev_______________________________________________ >>>> > TikiWiki-devel mailing list >>>> > Tik...@li... >>>> > https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel >>>> >>>> >>>> >>>> ------------------------------------------------------------------------------ >>>> EMC VNX: the world's simplest storage, starting under $10K >>>> The only unified storage solution that offers unified management >>>> Up to 160% more powerful than alternatives and 25% more efficient. >>>> Guaranteed. http://p.sf.net/sfu/emc-vnx-dev2dev >>>> _______________________________________________ >>>> TikiWiki-devel mailing list >>>> Tik...@li... >>>> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel >>>> >>> >>> >>> >>> ------------------------------------------------------------------------------ >>> EMC VNX: the world's simplest storage, starting under $10K >>> The only unified storage solution that offers unified management >>> Up to 160% more powerful than alternatives and 25% more efficient. >>> Guaranteed. http://p.sf.net/sfu/emc-vnx-dev2dev >>> _______________________________________________ >>> TikiWiki-devel mailing list >>> Tik...@li... >>> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel >>> >>> >> >> >> ------------------------------------------------------------------------------ >> EMC VNX: the world's simplest storage, starting under $10K >> The only unified storage solution that offers unified management >> Up to 160% more powerful than alternatives and 25% more efficient. >> Guaranteed. http://p.sf.net/sfu/emc-vnx-dev2dev >> _______________________________________________ >> TikiWiki-devel mailing list >> Tik...@li... >> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel >> >> > > > ------------------------------------------------------------------------------ > EMC VNX: the world's simplest storage, starting under $10K > The only unified storage solution that offers unified management > Up to 160% more powerful than alternatives and 25% more efficient. > Guaranteed. http://p.sf.net/sfu/emc-vnx-dev2dev > _______________________________________________ > TikiWiki-devel mailing list > Tik...@li... > https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel > > |