Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

Login/Activity Log Security Issue

#139

It's possible to enter JavsScript as a username when trying to login to Sitellite and whatever is entered will be executed upon viewing the activity log. Try entering a username of , any password, and then properly logging into Sitellite and then viewing your activity log and you'll see the popup. I'm not sure how much damage could be done but this should be sanitized when viewing the log.

Reported by labman · June 29th, 2009 @ 03:50 PM

State: resolved
Milestone: 5.0.3
Assigned to: lux lux

Activity

  1. lux
    lux
    • State changed from new to resolved

    I just committed a fix that sanitizes the usernames now. Here's a link to the commit:

    http://github.com/lux/sitellite/commit/e8f02bfb50e9825912e117d2090c...

    June 29th, 2009 @ 05:50 PM

  2. Charles Brunet
    Charles Brunet
    • Milestone set to 5.0.3

    [milestone:id#47011 bulk edit command]

    August 7th, 2009 @ 09:41 AM

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.