mahara-contributors team mailing list archive

Thread
Date

[Bug 1719480] Re: Webservice test client / elasticsearch not escaping returned dumped values to screen

To: mahara-contributors@xxxxxxxxxxxxxxxxxxx
From: Robert Lyon <robertl@xxxxxxxxxxxxxxx>
Date: Mon, 30 Oct 2017 07:36:00 -0000
Reply-to: Bug 1719480 <1719480@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx

** Changed in: mahara/16.10
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
Matching subscriptions: Subscription for all Mahara Contributors -- please ask on #mahara-dev or mahara.org forum before editing or unsubscribing it!
https://bugs.launchpad.net/bugs/1719480

Title:
  Webservice test client / elasticsearch not escaping returned dumped
  values to screen

Status in Mahara:
  Fix Released
Status in Mahara 15.04 series:
  Fix Released
Status in Mahara 16.04 series:
  Fix Released
Status in Mahara 16.10 series:
  Fix Released
Status in Mahara 17.04 series:
  Fix Committed
Status in Mahara 17.10 series:
  Fix Released

Bug description:
  Similar problem to Bug 1719472 
  where we have a user with display name set to '<script>alert(1)</script>'

  When fetching this user via webservices the test client displays the
  output to screen without escaping it

To manage notifications about this bug go to:
https://bugs.launchpad.net/mahara/+bug/1719480/+subscriptions