[otrs-cvs] ITSMChangeManagement/Kernel/Modules AgentITSMWorkOrderZoom.pm, 1.51, 1.51.2.1 AgentITSMChangeZoom.pm, 1.59, 1.59.2.1

Comments:
Update of /home/cvs/ITSMChangeManagement/Kernel/Modules
In directory lancelot:/tmp/cvs-serv20648/Kernel/Modules

Modified Files:
      Tag: rel-3_0
	AgentITSMWorkOrderZoom.pm AgentITSMChangeZoom.pm 
Log Message:
Fixed possible security issue by filtering out active HTML content.

Author: ub

Index: AgentITSMWorkOrderZoom.pm
===================================================================
RCS file: /home/cvs/ITSMChangeManagement/Kernel/Modules/AgentITSMWorkOrderZoom.pm,v
retrieving revision 1.51
retrieving revision 1.51.2.1
diff -2 -u -d -r1.51 -r1.51.2.1
--- AgentITSMWorkOrderZoom.pm	20 Dec 2010 14:30:38 -0000	1.51
+++ AgentITSMWorkOrderZoom.pm	26 Mar 2013 11:52:09 -0000	1.51.2.1
@@ -1,5 +1,5 @@
 # --
 # Kernel/Modules/AgentITSMWorkOrderZoom.pm - the OTRS::ITSM::ChangeManagement workorder zoom module
-# Copyright (C) 2001-2010 OTRS AG, http://otrs.org/
+# Copyright (C) 2001-2013 OTRS AG, http://otrs.org/
 # --
 # $Id$
@@ -15,4 +15,5 @@
 use warnings;
 
+use Kernel::System::HTMLUtils;
 use Kernel::System::ITSMChange;
 use Kernel::System::ITSMChange::ITSMWorkOrder;
@@ -40,4 +41,5 @@
 
     # create needed objects
+    $Self->{HTMLUtilsObject} = Kernel::System::HTMLUtils->new(%Param);
     $Self->{ChangeObject}    = Kernel::System::ITSMChange->new(%Param);
     $Self->{WorkOrderObject} = Kernel::System::ITSMChange::ITSMWorkOrder->new(%Param);
@@ -93,4 +95,27 @@
     }
 
+    # clean the richt text fields from active HTML content
+    ATTRIBUTE:
+    for my $Attribute (qw(Instruction Report)) {
+
+        next ATTRIBUTE if !$WorkOrder->{$Attribute};
+
+        # remove active html content (scripts, applets, etc...)
+        my %SafeContent = $Self->{HTMLUtilsObject}->Safety(
+            String       => $WorkOrder->{$Attribute},
+            NoApplet     => 1,
+            NoObject     => 1,
+            NoEmbed      => 1,
+            NoIntSrcLoad => 0,
+            NoExtSrcLoad => 0,
+            NoJavaScript => 1,
+        );
+
+        # take the safe content if neccessary
+        if ( $SafeContent{Replace} ) {
+            $WorkOrder->{$Attribute} = $SafeContent{String};
+        }
+    }
+
     # handle DownloadAttachment
     if ( $Self->{Subaction} eq 'DownloadAttachment' ) {

Author: ub

Index: AgentITSMChangeZoom.pm
===================================================================
RCS file: /home/cvs/ITSMChangeManagement/Kernel/Modules/AgentITSMChangeZoom.pm,v
retrieving revision 1.59
retrieving revision 1.59.2.1
diff -2 -u -d -r1.59 -r1.59.2.1
--- AgentITSMChangeZoom.pm	21 Dec 2010 13:06:15 -0000	1.59
+++ AgentITSMChangeZoom.pm	26 Mar 2013 11:52:09 -0000	1.59.2.1
@@ -1,5 +1,5 @@
 # --
 # Kernel/Modules/AgentITSMChangeZoom.pm - the OTRS::ITSM::ChangeManagement change zoom module
-# Copyright (C) 2001-2010 OTRS AG, http://otrs.org/
+# Copyright (C) 2001-2013 OTRS AG, http://otrs.org/
 # --
 # $Id$
@@ -15,4 +15,5 @@
 use warnings;
 
+use Kernel::System::HTMLUtils;
 use Kernel::System::LinkObject;
 use Kernel::System::CustomerUser;
@@ -41,4 +42,5 @@
 
     # create needed objects
+    $Self->{HTMLUtilsObject}    = Kernel::System::HTMLUtils->new(%Param);
     $Self->{LinkObject}         = Kernel::System::LinkObject->new(%Param);
     $Self->{CustomerUserObject} = Kernel::System::CustomerUser->new(%Param);
@@ -95,4 +97,27 @@
     }
 
+    # clean the richt text fields from active HTML content
+    ATTRIBUTE:
+    for my $Attribute (qw(Description Justification)) {
+
+        next ATTRIBUTE if !$Change->{$Attribute};
+
+        # remove active html content (scripts, applets, etc...)
+        my %SafeContent = $Self->{HTMLUtilsObject}->Safety(
+            String       => $Change->{$Attribute},
+            NoApplet     => 1,
+            NoObject     => 1,
+            NoEmbed      => 1,
+            NoIntSrcLoad => 0,
+            NoExtSrcLoad => 0,
+            NoJavaScript => 1,
+        );
+
+        # take the safe content if neccessary
+        if ( $SafeContent{Replace} ) {
+            $Change->{$Attribute} = $SafeContent{String};
+        }
+    }
+
     # handle DownloadAttachment
     if ( $Self->{Subaction} eq 'DownloadAttachment' ) {
@@ -557,4 +582,8 @@
             );
 
+            $User{UserLogin}     ||= '';
+            $User{UserFirstname} ||= '';
+            $User{UserLastname}  ||= '';
+
             $ChangeInitiators .= sprintf "%s (%s %s)",
                 $User{UserLogin},
---------------------------------------------------------------------
OTRS mailing list: cvs-log - Webpage: http://otrs.org/
Archive: http://lists.otrs.org/pipermail/cvs-log
To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/cvs-log