mahara-contributors team mailing list archive

Thread
Date

[Bug 817342] Re: Unencoded strings included in viewacl javascript

To: mahara-contributors@xxxxxxxxxxxxxxxxxxx
From: François Marier <francois@xxxxxxxxxx>
Date: Thu, 03 Nov 2011 22:16:51 -0000
Reply-to: Bug 817342 <817342@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx

** Changed in: mahara/1.3
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
https://bugs.launchpad.net/bugs/817342

Title:
  Unencoded strings included in viewacl javascript

Status in Mahara ePortfolio:
  Fix Released
Status in Mahara 1.3 series:
  Fix Released
Status in Mahara 1.4 series:
  Fix Released

Bug description:
  The viewacl template has javascript which includes strings directly
  from the language pack in single quotes instead of json encoded.
  Strings containing single quotes will result in syntax errors and will
  stop the js from executing.

  I'll mark this as "security" till I've had a chance to discuss it with
  the others, but it's only exploitable by language pack maintainers, so
  it's probably better as public.

To manage notifications about this bug go to:
https://bugs.launchpad.net/mahara/+bug/817342/+subscriptions