Page MenuHomePhabricator

CVE-2024-40602: Tempo skin: stored XSS via MediaWiki:Sidebar
Closed, ResolvedPublicSecurity

Description

A continuation of T361448, T361449 & T361450, just for a different skin.

Proposed & tested patch:

diff --git a/Tempo.skin.php b/Tempo.skin.php
index fcb1f91..9cb7824 100644
--- a/Tempo.skin.php
+++ b/Tempo.skin.php
@@ -156,7 +156,7 @@ class TempoTemplate extends BaseTemplate {
                                        <div id="sidebar" role="navigation">
                                                <?php
                                                        foreach ( $this->getSidebar() as $boxName => $box ) { ?>
-                                                                               <section id="<?php echo Sanitizer::escapeIdForAttribute( $box['id'] ) ?>"<?php echo Linker::tooltip( $box['id'] ) ?>>
+                                                                               <section id="<?php echo htmlspecialchars( Sanitizer::escapeIdForAttribute( $box['id'] ), ENT_QUOTES ) ?>"<?php echo Linker::tooltip( $box['id'] ) ?>>
                                                                                <div class="top"><h3><?php echo htmlspecialchars( $box['header'] ); ?></h3></div>
 
                                                                                <?php if ( is_array( $box['content'] ) ) { ?>

Event Timeline

Since this skin isn't deployed or bundled, the proposed patch can go through gerrit at any time. It will be (re)announced via the next supplemental security release: T361321.

This patch, too, got merged a while ago.

Reedy changed the visibility from "Custom Policy" to "Public (No Login Required)".May 20 2024, 11:33 AM
Reedy changed the edit policy from "Custom Policy" to "All Users".

Change #1051776 had a related patch set uploaded (by Mmartorana; author: Jack Phoenix):

[mediawiki/skins/Tempo@REL1_41] SECURITY: avoid stored XSS via MediaWiki:Sidebar

https://gerrit.wikimedia.org/r/1051776

Change #1051777 had a related patch set uploaded (by Mmartorana; author: Jack Phoenix):

[mediawiki/skins/Tempo@REL1_40] SECURITY: avoid stored XSS via MediaWiki:Sidebar

https://gerrit.wikimedia.org/r/1051777

Change #1051778 had a related patch set uploaded (by Mmartorana; author: Jack Phoenix):

[mediawiki/skins/Tempo@REL1_39] SECURITY: avoid stored XSS via MediaWiki:Sidebar

https://gerrit.wikimedia.org/r/1051778

Change #1051777 abandoned by Umherirrender:

[mediawiki/skins/Tempo@REL1_40] SECURITY: avoid stored XSS via MediaWiki:Sidebar

Reason:

REL1_40 is end of life

https://gerrit.wikimedia.org/r/1051777

Change #1051778 merged by jenkins-bot:

[mediawiki/skins/Tempo@REL1_39] SECURITY: avoid stored XSS via MediaWiki:Sidebar

https://gerrit.wikimedia.org/r/1051778

Change #1051776 merged by jenkins-bot:

[mediawiki/skins/Tempo@REL1_41] SECURITY: avoid stored XSS via MediaWiki:Sidebar

https://gerrit.wikimedia.org/r/1051776

mmartorana renamed this task from Tempo skin: stored XSS via MediaWiki:Sidebar to CVE-2024-40602: Tempo skin: stored XSS via MediaWiki:Sidebar.Jul 8 2024, 5:36 PM