Ticket #79 (assigned defect)

Opened 3 years ago

Last modified 15 months ago

Strip out HTML in all user input (apart from node content)

Reported by: dom Owned by: dom
Priority: high Milestone:
Component: openguides Version: svn
Severity: normal Keywords: hackfestsummer2007-reviewed
Cc:

Description

A new spamming ploy is to use <a href ... node names. This results in much easier linkspamming and should be filtered out.

Change History

Changed 3 years ago by dom

  • status changed from new to assigned
  • milestone set to 0.52

Changed 3 years ago by dom

  • summary changed from Strip out HTML in node names to Strip out HTML in all user input (apart from node content)
  • milestone changed from 0.52 to 0.53

See also #68.

Changed 2 years ago by dom

(In [775]) Quick fix to partially fix HTML spam problem (references #79)

Changed 2 years ago by dom

  • milestone changed from 0.53 to 0.54

Proper fix needs Wiki::Toolkit and better commit hooks.

Changed 2 years ago by anonymous

hello

salut je cherche une povoir pour savi

Changed 22 months ago by dom

  • milestone 0.58 deleted

Changed 22 months ago by dom

  • owner dom deleted
  • status changed from assigned to new

Changed 16 months ago by dom

  • owner set to Nobody

Changed 16 months ago by Kake

Decision: Run all user input through CGI::escapeHTML in the commit_node method of OpenGuides.pm after we call OpenGuides::Template to extract the variables from the CGI object. Also, move Dom's temporary escaping here from OpenGuides::Template (changeset

Error: Failed to load processor 775
No macro or processor named '775' found

).

Changed 16 months ago by Kake

  • keywords hackfestsummer2007-reviewed added

Changed 16 months ago by Kake

See also #22, the same person should do these.

Changed 16 months ago by dom

  • owner changed from Nobody to dom
  • status changed from new to assigned

Changed 16 months ago by dom

The escaping shouldn't be done in the commit_node, but in the HTML presentation logic. Some templates already use CGI.escapeHTML in them; it would probably be appropriate to do the same here.

Changed 16 months ago by dom

TT apparently has its own internal HTML filtering capability.

Changed 16 months ago by dom

After further consideration, Template.pm is the correct place to do this. Action: wait until #21 has been fixed (otherwise the website text cannot be filtered) and then CGI::escapeHTML all the metadata in Template->output after extract_metadata_vars has been called.

Changed 15 months ago by dom

See also #233 - make sure that escapeHTML does what it should with quotes.

Note: See TracTickets for help on using tickets.