Skip to content

Commit b014da5

Browse files
committed
Fix XSS in search page
Dmitry Ivanov [d1m0ck](https://twitter.com/d1m0ck) reported[*1] a security vulnerability in the Source Integration plugin's search results page, allowing an attacker to inject arbitrary HTML or javascript code (the latter, only if MantisBT's default CSP are disabled). Proper escaping of the permalink resolves the issue. Fixes #205 [*1]: http://openbugbounty.org/incidents/218993/
1 parent f4b67d7 commit b014da5

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

Source/pages/search.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,10 +37,10 @@
3737
<div class="table-responsive">
3838

3939
<div class="widget-toolbox padding-8 clearfix">
40-
<a class="btn btn-xs btn-primary btn-white btn-round" href="<?php echo plugin_page( 'search' ) . $t_permalink ?>">
40+
<a class="btn btn-xs btn-primary btn-white btn-round" href="<?php echo plugin_page( 'search' ) . string_attribute( $t_permalink ) ?>">
4141
<?php echo plugin_lang_get( 'permalink' ) ?>
4242
</a>
43-
<a class="btn btn-xs btn-primary btn-white btn-round" href="<?php echo plugin_page( 'search_page' ) . $t_permalink ?>">
43+
<a class="btn btn-xs btn-primary btn-white btn-round" href="<?php echo plugin_page( 'search_page' ) . string_attribute( $t_permalink ) ?>">
4444
<?php echo plugin_lang_get( 'modify_search' ) ?>
4545
</a>
4646
<a class="btn btn-xs btn-primary btn-white btn-round" href="<?php echo plugin_page( 'search_page' ) ?>">

0 commit comments

Comments
 (0)