Bug 330555: [SECURITY] H1, H2 and H3 are not filtered in global/header.html.tmpl...

diff --git a/CGI.pl b/CGI.pl
index 862cb7a8b1a322fcb032877206ba0eaecee857d0..fdae61c3e7dfbcf0aef8319703c6da9f3248fc58 100644 (file)
--- a/CGI.pl
+++ b/CGI.pl
@@ -236,8 +236,13 @@ sub MailPassword {
 }
 
 sub PutHeader {
-    ($vars->{'title'}, $vars->{'h1'}, $vars->{'h2'}) = (@_);
-     
+    my ($title, $h1, $h2) = @_;
+
+    # We filter fields here.
+    $vars->{'title'} = html_quote($title) if defined $title;
+    $vars->{'h1'} = html_quote($h1) if defined $h1;
+    $vars->{'h2'} = html_quote($h2) if defined $h2;
+
     $::template->process("global/header.html.tmpl", $::vars)
       || ThrowTemplateError($::template->error());
     $vars->{'header_done'} = 1;

diff --git a/editgroups.cgi b/editgroups.cgi
index 2d4911ec74e135dcc80cf213a8e535ed16e92908..cfd5545ad32c75abe30ef16845bb917fc871b476 100755 (executable)
--- a/editgroups.cgi
+++ b/editgroups.cgi
@@ -673,10 +673,9 @@ if (($action eq 'remove_all_regexp') || ($action eq 'remove_all')) {
     my ($name, $regexp) = $sth->fetchrow_array();
     if ($action eq 'remove_all_regexp') {
         PutHeader("Removing All Explicit Group Memberships Matching "
-                . "Group RegExp from \'" . html_quote($name) . "\'");
+                . "Group RegExp from \'$name\'");
     } else {
-        PutHeader("Removing All Explicit Group Memberships from \'"
-                . html_quote($name) . "\'");
+        PutHeader("Removing All Explicit Group Memberships from \'$name\'");
     }
     $dbh->do("LOCK TABLES
                   groups WRITE,

diff --git a/template/en/default/admin/flag-type/edit.html.tmpl b/template/en/default/admin/flag-type/edit.html.tmpl
index b09c70cc9d8b934d87162ee5eb404b53cb46b47f..685e7c08f0cbcd9b5820bae27d99ae91e08f192f 100644 (file)
--- a/template/en/default/admin/flag-type/edit.html.tmpl
+++ b/template/en/default/admin/flag-type/edit.html.tmpl
@@ -44,9 +44,9 @@
 [% END %]
 
 [% IF last_action == "copy" %]
-  [% title = "Create Flag Type Based on $type.name" %]
+  [% title = BLOCK %]Create Flag Type Based on [% type.name FILTER html %][% END %]
 [% ELSIF last_action == "edit" %]
-  [% title = "Edit Flag Type $type.name" %]
+  [% title = BLOCK %]Edit Flag Type [% type.name FILTER html %][% END %]
 [% END %]
 
 [% PROCESS global/header.html.tmpl

diff --git a/template/en/default/admin/products/groupcontrol/confirm-edit.html.tmpl b/template/en/default/admin/products/groupcontrol/confirm-edit.html.tmpl
index 006189c13d78a8facd55f48d457b2551c7bad77c..cc4048d4816089502916550c0bf16ec50da4d744 100644 (file)
--- a/template/en/default/admin/products/groupcontrol/confirm-edit.html.tmpl
+++ b/template/en/default/admin/products/groupcontrol/confirm-edit.html.tmpl
@@ -22,7 +22,9 @@
 
 [% PROCESS global/variables.none.tmpl %]
 
-[% PROCESS global/header.html.tmpl title="Confirm Group Control Change for product \'$product\'" %]
+[% title = BLOCK %]Confirm Group Control Change for product '[% product FILTER html %]'[% END %]
+
+[% PROCESS global/header.html.tmpl title = title %]
 
 [% FOREACH group = mandatory_groups %]
 <P>

diff --git a/template/en/default/bug/show.html.tmpl b/template/en/default/bug/show.html.tmpl
index 8db59a9800444047e56d2f65e1af68e119fdffa3..e1e824dc07d74a18c7643e5732b7e5cb06f2d366 100644 (file)
--- a/template/en/default/bug/show.html.tmpl
+++ b/template/en/default/bug/show.html.tmpl
@@ -29,7 +29,7 @@
 [% filtered_desc = bug.short_desc FILTER html %]
 [% filtered_timestamp = bug.delta_ts FILTER time %]
 [% PROCESS global/header.html.tmpl
-  title = "$terms.Bug $bug.bug_id - $bug.short_desc"
+  title = "$terms.Bug $bug.bug_id - $filtered_desc"
   h1 = "$terms.Bugzilla $terms.Bug $bug.bug_id"
   h2 = filtered_desc
   h3 = "Last modified: $filtered_timestamp"

diff --git a/template/en/default/filterexceptions.pl b/template/en/default/filterexceptions.pl
index 08f885175bbdc3ebf7c85213b34473668fdd6d88..72440c9d40ee60ab2589d684a966456fbb13ab5f 100644 (file)
--- a/template/en/default/filterexceptions.pl
+++ b/template/en/default/filterexceptions.pl
@@ -248,6 +248,7 @@
   'bgcolor', 
   'onload',
   'bodyattrs', 
+  'title',
   'h1',
   'h2',
   'h3', 

diff --git a/template/en/default/global/header.html.tmpl b/template/en/default/global/header.html.tmpl
index a4314fdfa6d81553dade7a7a03d0cfa9da07fa7e..0422c2af99692462c1679b824d5a679796df7522 100644 (file)
--- a/template/en/default/global/header.html.tmpl
+++ b/template/en/default/global/header.html.tmpl
@@ -61,7 +61,7 @@
 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
 <html>
   <head>
-    <title>[% title FILTER html %]</title>
+    <title>[% title %]</title>
 
 [%# Migration note: contents of the old Param 'headerhtml' would go here %]
 

diff --git a/template/en/default/list/list.html.tmpl b/template/en/default/list/list.html.tmpl
index c244b3f0c62d08e54bd57ce8750ac42095dc8b69..c17f40ff28c21c61b522a639ae925dd5dbefb211 100644 (file)
--- a/template/en/default/list/list.html.tmpl
+++ b/template/en/default/list/list.html.tmpl
@@ -33,7 +33,7 @@
 
 [% title = "$terms.Bug List" %]
 [% IF searchname %]
-  [% title = title _ ": " _ searchname %]
+  [% title = title _ ": " _ searchname FILTER html %]
 [% END %]
 
 [% style_urls = [ "css/buglist.css" ] %]

diff --git a/template/en/default/reports/components.html.tmpl b/template/en/default/reports/components.html.tmpl
index c3a3ae5162e632a3d78be4ac9b6901df00f61428..e0f0cf33de3a0d2431de0e8d6f2c7e5da3b15c1a 100644 (file)
--- a/template/en/default/reports/components.html.tmpl
+++ b/template/en/default/reports/components.html.tmpl
@@ -30,7 +30,7 @@
   
 [% filtered_product = product FILTER html %]
 [% PROCESS global/header.html.tmpl 
-  title = "Components for $product"
+  title = "Components for $filtered_product"
   h2 = filtered_product %]
 
 [% IF Param("useqacontact") %]

diff --git a/template/en/default/reports/duplicates.html.tmpl b/template/en/default/reports/duplicates.html.tmpl
index 5cbf84fe267c267eae40d8ba522c1b607195b2fc..764bfb8fb23915e9b01080852ce24e76e5b74159 100644 (file)
--- a/template/en/default/reports/duplicates.html.tmpl
+++ b/template/en/default/reports/duplicates.html.tmpl
@@ -36,7 +36,9 @@
 [% PROCESS global/variables.none.tmpl %]
 
 [% IF query_products.size %]
-  [% title = "Most Frequently Reported $terms.Bugs for ${query_products.join(', ')}" %]
+  [% title = BLOCK %]
+    Most Frequently Reported [% terms.Bugs %] for [% query_products.join(', ') FILTER html %]
+  [% END %]
 [% ELSE %]
   [% title = "Most Frequently Reported $terms.Bugs" %]
 [% END%]