[pLog-svn] r6443 - plog/branches/lifetype-1.2/templates/admin

[reto at devel.lifetype.net]

Author: reto
Date: 2008-05-05 14:41:09 -0400 (Mon, 05 May 2008)
New Revision: 6443

Modified:
   plog/branches/lifetype-1.2/templates/admin/addbloguser.template
Log:
sh** we may have a more serious issue with input validation. It's not obvious in the action classes that, if some validators fail and the error view outputs data from the request that data never get's filtered.
That's for example the issue in adminaddbloguseraction.class.php where the new username only get's sanitized if it validates.

this one here is just the fix for the new XSS vuln. (yes, he reported again). guess I was too optimistic with the release. We really should take time and rethink our input validation.



Modified: plog/branches/lifetype-1.2/templates/admin/addbloguser.template
===================================================================
--- plog/branches/lifetype-1.2/templates/admin/addbloguser.template	2008-05-05 18:25:43 UTC (rev 6442)
+++ plog/branches/lifetype-1.2/templates/admin/addbloguser.template	2008-05-05 18:41:09 UTC (rev 6443)
@@ -11,7 +11,7 @@
       <label for="userName">{$locale->tr("username")}</label>
       <span class="required">*</span>
       <div class="formHelp">{$locale->tr("new_blog_username_help")}</div>
-      <input type="text" id="userName" name="newBlogUserName" value="{$newBlogUserName}" style="width:50%" />
+      <input type="text" id="userName" name="newBlogUserName" value="{$newBlogUserName|escape:"html"}" style="width:50%" />
 	  {check_perms adminperm=view_users}
 	   <a href="#" onclick="window.open('?op=siteUsersChooser','UserChooser','scrollbars=yes,resizable=yes,toolbar=no,height=450,width=600');">
 		{$locale->tr("select")}