Deprecated: Methods with the same name as their class will not be constructors in a future version of PHP; Doku_LexerParallelRegex has a deprecated constructor in /var/www/vhosts/conlite.org/httpdocs/dev/tickets/plugins/dokuwiki/inc/parser/lexer.php on line 35 Deprecated: Methods with the same name as their class will not be constructors in a future version of PHP; Doku_LexerStateStack has a deprecated constructor in /var/www/vhosts/conlite.org/httpdocs/dev/tickets/plugins/dokuwiki/inc/parser/lexer.php on line 229 Deprecated: Methods with the same name as their class will not be constructors in a future version of PHP; Doku_Lexer has a deprecated constructor in /var/www/vhosts/conlite.org/httpdocs/dev/tickets/plugins/dokuwiki/inc/parser/lexer.php on line 285 Deprecated: Methods with the same name as their class will not be constructors in a future version of PHP; Doku_Handler has a deprecated constructor in /var/www/vhosts/conlite.org/httpdocs/dev/tickets/plugins/dokuwiki/inc/parser/handler.php on line 4 Deprecated: Methods with the same name as their class will not be constructors in a future version of PHP; Doku_Handler_CallWriter has a deprecated constructor in /var/www/vhosts/conlite.org/httpdocs/dev/tickets/plugins/dokuwiki/inc/parser/handler.php on line 699 Deprecated: Methods with the same name as their class will not be constructors in a future version of PHP; Doku_Handler_Nest has a deprecated constructor in /var/www/vhosts/conlite.org/httpdocs/dev/tickets/plugins/dokuwiki/inc/parser/handler.php on line 728 Deprecated: Methods with the same name as their class will not be constructors in a future version of PHP; Doku_Handler_List has a deprecated constructor in /var/www/vhosts/conlite.org/httpdocs/dev/tickets/plugins/dokuwiki/inc/parser/handler.php on line 770 Deprecated: Methods with the same name as their class will not be constructors in a future version of PHP; Doku_Handler_Preformatted has a deprecated constructor in /var/www/vhosts/conlite.org/httpdocs/dev/tickets/plugins/dokuwiki/inc/parser/handler.php on line 963 Deprecated: Methods with the same name as their class will not be constructors in a future version of PHP; Doku_Handler_Quote has a deprecated constructor in /var/www/vhosts/conlite.org/httpdocs/dev/tickets/plugins/dokuwiki/inc/parser/handler.php on line 1017 Deprecated: Methods with the same name as their class will not be constructors in a future version of PHP; Doku_Handler_Table has a deprecated constructor in /var/www/vhosts/conlite.org/httpdocs/dev/tickets/plugins/dokuwiki/inc/parser/handler.php on line 1109 Deprecated: Methods with the same name as their class will not be constructors in a future version of PHP; Doku_Handler_Block has a deprecated constructor in /var/www/vhosts/conlite.org/httpdocs/dev/tickets/plugins/dokuwiki/inc/parser/handler.php on line 1386 FS#171 : System and client allows xss in backend

ConLite

  • Status Closed
  • Percent Complete
    100%
  • Task Type Bug Report
  • Category Backend
  • Assigned To
    Ortwin Pinke
  • Operating System All
  • Severity Critical
  • Priority Very High
  • Reported Version ConLite 2.0 RC
  • Due in Version ConLite 2.0.0
  • Due Date Undecided
  • Votes
  • Private
Attached to Project: ConLite
Opened by Ortwin Pinke - 29.06.2017
Last edited by Ortwin Pinke - 06.07.2017

FS#171 - System and client allows xss in backend

Go to administration → system → expert settings.
Create new setting and set value to: <script>alert(”XSS Alert”);</script>
Script will be executed. Same with client settings

Closed by  Ortwin Pinke
06.07.2017 09:31
Reason for closing:  Fixed
Deprecated: Function create_function() is deprecated in /var/www/vhosts/conlite.org/httpdocs/dev/tickets/includes/class.user.php on line 115 Project Manager
Ortwin Pinke commented on 06.07.2017 06:22

Also check other fields in formular for xss, a bad one would also use type or name field.

Loading...

Available keyboard shortcuts

Tasklist

Task Details

Task Editing