Commit b014da5
committed
Fix XSS in search page
Dmitry Ivanov [d1m0ck](https://twitter.com/d1m0ck) reported[*1] a
security vulnerability in the Source Integration plugin's search results
page, allowing an attacker to inject arbitrary HTML or javascript code
(the latter, only if MantisBT's default CSP are disabled).
Proper escaping of the permalink resolves the issue.
Fixes #205
[*1]: http://openbugbounty.org/incidents/218993/1 parent f4b67d7 commit b014da5
1 file changed
+2
-2
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
37 | 37 | | |
38 | 38 | | |
39 | 39 | | |
40 | | - | |
| 40 | + | |
41 | 41 | | |
42 | 42 | | |
43 | | - | |
| 43 | + | |
44 | 44 | | |
45 | 45 | | |
46 | 46 | | |
| |||
0 commit comments