Vote #79548
完了Missing validation for custom field formats based on RecordList
0%
説明
No validation is performed on input given to custom field formats
- EnumerationFormat
- UserFormat
- VersionFormat
(all based on RecordList). While displayed choices are properly restricted, manipulation of the form on the client side allows to send arbitrary record IDs, which will be accepted without further checks.
The attached patch (tested on Redmine 3.4.6) adds a validation function to RecordList.
journals
+1
I also think that the validation that 'Alexander Achenbach' pointed out should be done.
Actually, by manipulating the form on the client side, it was possible to send arbitrary record ID.
I added a test code to the patch made by 'Alexander Achenbach' and attach it.
--------------------------------------------------------------------------------
Setting the target version to 3.3.9.
--------------------------------------------------------------------------------
Patch committed, thanks.
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
Reverted from 3.3-stable, ProjectCopyTest#test_copy_issues_should_reassign_version_custom_fields_to_copied_versions was failing.
--------------------------------------------------------------------------------