pixeldrain/fnx_web
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix xss on account settings page

Browse Source
This commit is contained in:
Wim Brand
2020-12-24 00:07:40 +01:00
parent 0b7515eccd
commit 96ca0ed90f
3 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
res/include/md/acknowledgements.md
View File

@@ -30,7 +30,8 @@
* 2020-12-06 Security researcher Arian Firoozfar reported a cross-site * 2020-12-06 Security researcher Arian Firoozfar reported a cross-site
scripting vulnerability on the file viewer page. The issue was fixed the scripting vulnerability on the file viewer page. The issue was fixed the
following day. following day. On the 26th another XSS vulnerability was found on the account
settings page, it was fixed later that day.
* 2017-12-04 Security researcher Hangyi reported a cross-site scripting * 2017-12-04 Security researcher Hangyi reported a cross-site scripting
vulnerability on the file viewer page. The issue was fixed on the 6th. vulnerability on the file viewer page. The issue was fixed on the 6th.

4
res/template/server_status.html
View File

@@ -16,8 +16,8 @@
<body> <body>
{{template "page_menu" .}} {{template "page_menu" .}}
<div class="page_body" style="padding: 0; top: 0; bottom: 0;"> <div id="page_body" class="page_body" style="padding: 0; top: 0; bottom: 0;">
<iframe id="page_body" src="https://status.pixeldrain.com" class="status_frame"></iframe> <iframe src="https://status.pixeldrain.com" class="status_frame"></iframe>
</div> </div>
{{template "analytics"}} {{template "analytics"}}
</body> </body>

3
webcontroller/user_settings.go
View File

@@ -2,6 +2,7 @@ package webcontroller
import ( import (
"fmt" "fmt"
"html"
"html/template" "html/template"
"net/http" "net/http"
@@ -211,7 +212,7 @@ func (wc *WebController) usernameForm(td *TemplateData, r *http.Request) (f Form
// Request was a success // Request was a success
f.SubmitSuccess = true f.SubmitSuccess = true
f.SubmitMessages = []template.HTML{template.HTML( f.SubmitMessages = []template.HTML{template.HTML(
"Success! You are now " + f.FieldVal("new_username"), "Success! You are now " + html.EscapeString(f.FieldVal("new_username")),
)} )}
} }
} }