Page MenuHomePhabricator
Create Task
Maniphest T116382

Raw html should be escaped before output in Newsletter pages
Closed, ResolvedPublic
Actions

Description

There's several places where we output directly from the db. It should be escaped before being output

Details

SubjectRepoBranchLines +/-
Cleanup notification sent for new issuesmediawiki/extensions/Newslettermaster+44 -28
Escape raw HTML from SpecialNewslettermediawiki/extensions/Newslettermaster+24 -14
Do escaping before output on Newsletter special pagesmediawiki/extensions/Newslettermaster+16 -15
Customize query in gerrit

Related Objects
Search...

Event Timeline

Glaisher created this task.Oct 23 2015, 2:46 PM
Glaisher raised the priority of this task from to High.
Glaisher updated the task description. (Show Details)
Glaisher added a project: MediaWiki-extensions-Newsletter.
Glaisher subscribed.
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptOct 23 2015, 2:46 PM
Glaisher moved this task from Backlog to Feature complete on the MediaWiki-extensions-Newsletter board.Oct 23 2015, 2:46 PM
Glaisher moved this task from Feature complete to Technical review on the MediaWiki-extensions-Newsletter board.
Glaisher added a parent task: T115095: Security review of Newsletter extension.
gerritbot subscribed.Oct 23 2015, 4:25 PM

Change 248361 had a related patch set uploaded (by Glaisher):
Do escaping before output on Newsletter special pages

https://gerrit.wikimedia.org/r/248361

gerritbot added a project: Patch-For-Review.Oct 23 2015, 4:25 PM
• MZMcBride subscribed.Oct 24 2015, 6:01 PM
gerritbot added a comment.Oct 26 2015, 11:43 AM

Change 248361 merged by jenkins-bot:
Do escaping before output on Newsletter special pages

https://gerrit.wikimedia.org/r/248361

Glaisher mentioned this in T116353: Design feedback on the Newsletter extension.Oct 31 2015, 11:37 AM
gerritbot added a comment.Nov 2 2015, 5:41 PM

Change 250459 had a related patch set uploaded (by Glaisher):
Escape raw HTML from SpecialNewsletter

https://gerrit.wikimedia.org/r/250459

gerritbot added a comment.Nov 2 2015, 7:16 PM

Change 250459 merged by jenkins-bot:
Escape raw HTML from SpecialNewsletter

https://gerrit.wikimedia.org/r/250459

Tinaj1234 subscribed.Nov 12 2015, 9:35 AM

@Glaisher, this one can be marked 'Resolved'? :)

Glaisher added a comment.Nov 12 2015, 11:46 AM
In T116382#1800519, @Tinaj1234 wrote:

@Glaisher, this one can be marked 'Resolved'? :)

Not yet. Someone needs to confirm that they don't see raw HTML anywhere.

Glaisher removed a project: Patch-For-Review.Nov 12 2015, 11:46 AM
Glaisher set Security to None.
Glaisher added a comment.Nov 12 2015, 4:21 PM

Just noticed this so adding here so that I don't forget: Escape HTML in the notification too.

Tinaj1234 mentioned this in T115095: Security review of Newsletter extension.Nov 19 2015, 5:22 PM
gerritbot added a comment.Nov 24 2015, 6:17 AM

Change 255076 had a related patch set uploaded (by Glaisher):
Cleanup notification sent for new issues

https://gerrit.wikimedia.org/r/255076

gerritbot added a project: Patch-For-Review.Nov 24 2015, 6:17 AM
gerritbot added a comment.Nov 28 2015, 4:07 PM

Change 255076 merged by jenkins-bot:
Cleanup notification sent for new issues

https://gerrit.wikimedia.org/r/255076

Glaisher closed this task as Resolved.Dec 10 2015, 12:03 PM
Glaisher claimed this task.
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits