Quotes missing?

[lmnop]

Hi, just something minor I noticed (maybe even a non-issue),

On line 30 of templates/user/createAccount.tpl, I think quotes might need to be added around the value to prevent someone from injecting some funny code since $source is obtained directly from the URL. It doesn't seem to escape spaces from the URL (%20), so it might be possible to add JavaScript code in the form of a separate (maybe browser specific) attribute in the tag. Maybe I'm letting my paranoia get the best of me though...

The line looks like (this is from the CVS checkout):

Code: Select all

{if $source}
  <input type="hidden" name="source" value={$source|escape}/>
{/if}


Thanks,
Will

[asmecher]

Hi Will,

That is indeed a bug -- I've created an entry for it and corrected it in CVS; see http://pkp.sfu.ca/bugzilla/show_bug.cgi?id=4069. A quick grep didn't turn up any other examples of the same problem. Most of the injection risks are mitigated by the "escape" modifier, though it may be possible to get some very simple Javascript through.

Regards,
Alec Smecher
Public Knowledge Project Team