[otrs-cvs] ITSMChangeManagement/Kernel/Modules AgentITSMWorkOrderZoom.pm, 1.52, 1.53 AgentITSMChangeZoom.pm, 1.61, 1.62

Comments:
Update of /home/cvs/ITSMChangeManagement/Kernel/Modules
In directory lancelot:/tmp/cvs-serv20670/Kernel/Modules

Modified Files:
	AgentITSMWorkOrderZoom.pm AgentITSMChangeZoom.pm 
Log Message:
Fixed possible security issue by filtering out active HTML content.

Author: ub

Index: AgentITSMWorkOrderZoom.pm
===================================================================
RCS file: /home/cvs/ITSMChangeManagement/Kernel/Modules/AgentITSMWorkOrderZoom.pm,v
retrieving revision 1.52
retrieving revision 1.53
diff -2 -u -d -r1.52 -r1.53
--- AgentITSMWorkOrderZoom.pm	5 Feb 2013 20:23:10 -0000	1.52
+++ AgentITSMWorkOrderZoom.pm	26 Mar 2013 11:52:20 -0000	1.53
@@ -15,4 +15,5 @@
 use warnings;
 
+use Kernel::System::HTMLUtils;
 use Kernel::System::ITSMChange;
 use Kernel::System::ITSMChange::ITSMWorkOrder;
@@ -40,4 +41,5 @@
 
     # create needed objects
+    $Self->{HTMLUtilsObject} = Kernel::System::HTMLUtils->new(%Param);
     $Self->{ChangeObject}    = Kernel::System::ITSMChange->new(%Param);
     $Self->{WorkOrderObject} = Kernel::System::ITSMChange::ITSMWorkOrder->new(%Param);
@@ -94,4 +96,27 @@
     }
 
+    # clean the richt text fields from active HTML content
+    ATTRIBUTE:
+    for my $Attribute (qw(Instruction Report)) {
+
+        next ATTRIBUTE if !$WorkOrder->{$Attribute};
+
+        # remove active html content (scripts, applets, etc...)
+        my %SafeContent = $Self->{HTMLUtilsObject}->Safety(
+            String       => $WorkOrder->{$Attribute},
+            NoApplet     => 1,
+            NoObject     => 1,
+            NoEmbed      => 1,
+            NoIntSrcLoad => 0,
+            NoExtSrcLoad => 0,
+            NoJavaScript => 1,
+        );
+
+        # take the safe content if neccessary
+        if ( $SafeContent{Replace} ) {
+            $WorkOrder->{$Attribute} = $SafeContent{String};
+        }
+    }
+
     # handle DownloadAttachment
     if ( $Self->{Subaction} eq 'DownloadAttachment' ) {

Author: ub

Index: AgentITSMChangeZoom.pm
===================================================================
RCS file: /home/cvs/ITSMChangeManagement/Kernel/Modules/AgentITSMChangeZoom.pm,v
retrieving revision 1.61
retrieving revision 1.62
diff -2 -u -d -r1.61 -r1.62
--- AgentITSMChangeZoom.pm	5 Feb 2013 20:23:10 -0000	1.61
+++ AgentITSMChangeZoom.pm	26 Mar 2013 11:52:20 -0000	1.62
@@ -15,4 +15,5 @@
 use warnings;
 
+use Kernel::System::HTMLUtils;
 use Kernel::System::LinkObject;
 use Kernel::System::CustomerUser;
@@ -41,4 +42,5 @@
 
     # create needed objects
+    $Self->{HTMLUtilsObject}    = Kernel::System::HTMLUtils->new(%Param);
     $Self->{LinkObject}         = Kernel::System::LinkObject->new(%Param);
     $Self->{CustomerUserObject} = Kernel::System::CustomerUser->new(%Param);
@@ -96,4 +98,27 @@
     }
 
+    # clean the richt text fields from active HTML content
+    ATTRIBUTE:
+    for my $Attribute (qw(Description Justification)) {
+
+        next ATTRIBUTE if !$Change->{$Attribute};
+
+        # remove active html content (scripts, applets, etc...)
+        my %SafeContent = $Self->{HTMLUtilsObject}->Safety(
+            String       => $Change->{$Attribute},
+            NoApplet     => 1,
+            NoObject     => 1,
+            NoEmbed      => 1,
+            NoIntSrcLoad => 0,
+            NoExtSrcLoad => 0,
+            NoJavaScript => 1,
+        );
+
+        # take the safe content if neccessary
+        if ( $SafeContent{Replace} ) {
+            $Change->{$Attribute} = $SafeContent{String};
+        }
+    }
+
     # handle DownloadAttachment
     if ( $Self->{Subaction} eq 'DownloadAttachment' ) {
---------------------------------------------------------------------
OTRS mailing list: cvs-log - Webpage: http://otrs.org/
Archive: http://lists.otrs.org/pipermail/cvs-log
To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/cvs-log