ID: 46667
Updated by: [email protected]
Reported By: [email protected]
-Status: Open
+Status: Closed
Bug Type: Website problem
Operating System: N/A
PHP Version: Irrelevant
New Comment:
Not a major XSS problem (since login is required to get here) but a
real problem nevertheless. clean() has been implemented so the textarea
should be fine now.
Previous Comments:
------------------------------------------------------------------------
[2008-11-29 17:09:35] [email protected]
I think something like the following patch should do:
http://phpfi.com/383500
Without converting html character, we get XSS :)
------------------------------------------------------------------------
[2008-11-28 23:50:05] [email protected]
Example:
https://master.php.net/note/edit/87304
------------------------------------------------------------------------
[2008-11-25 16:41:29] [email protected]
Description:
------------
When editing user notes on the PHP site via the popup through Master,
closing </textarea> tags typed in by the note contributors close out the
actual textarea in the form. This causes the remaining code to flow
over into parsed HTML below the editable textarea.
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=46667&edit=1
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.