Vote #66631
完了HTML part of issue mails is not properly escaped
開始日:
2010/02/18
期日:
進捗率:
0%
予定工数:
Redmineorg_URL:
category_id:
9
version_id:
17
issue_org_id:
4874
author_id:
2784
assigned_to_id:
0
comments:
2
status_id:
5
tracker_id:
1
plus1:
0
affected_version:
closed_on:
affected_version_id:
説明
The link to the issue in the HTML part of issue mails is not properly escaped. If a user inserts HTML tags into the issue subject, it is inserted unescaped into the email body which at least destroys the rendering or at worst allows sophistcated phishing attacks using specifically crafted issue subjects.
The attached patch against Redmine trunk (r3434) fixes this.
journals
Done in r3452 with a few more fixes.
--------------------------------------------------------------------------------
Merged in 0.9-stable in r3462.
--------------------------------------------------------------------------------
related_issues
duplicates,Closed,5178,<pre> tag in subject disrupts HTML email
いいね!0