In Special:EventDetails, there are a bunch of i18n-based XSSs reproducible via the x-xss language. To reproduce,
To reproduce:
- First, you need to choose the right wiki. The easiest way is to do this locally, enabling the x-xss language setting in your LS.php. Else you can use the beta cluster, but you will have to add HTML to the messages mentioned below for the XSS to show.
- Then, you will first need to create an event:
- Make sure you're logged-in
- Create a page in the Event: namespace
- In the popup that appears post-save, click "Enable registration"
- Fill out the form (just the dates are required), submit.
- Click the link to go back to the event page
- Now you need to register for the event as a participant. Ideally, you need to do this with at least 3 different accounts. When you open the event page as a non-organizer, you will find a "Register for event" button to do that.
- Once you have an event with at least 3 participants, click the "manage event" button in the event page (or go to Special:EventDetails/X where X is the ID of your event, if you know it)
- Switch to the "Participants" tab
Once you're there, there are a bunch of XSSs you can reproduce in different ways.
- Click the checkbox in the table header. You will see an alert from the campaignevents-email-participants-all message.
- Then, individually unselect 2 of the participants. You will see another alert from the campaignevents-email-participants-except-count message.
- Then, deselect everyone and individually select 2 participants. You'll get another alert from the campaignevents-email-participants-count message.
The root cause of these is the same: the code in question uses .append() instead of .text().
Note that this code is relatively recent (r936290, r944928), only included in wmf.41 branches, and only enabled in a few wikis (see wmgUseCampaignEvents).