From: Frédéric Buclin <LpSolit@gmail.com>
Date: Wed, 8 Feb 2012 15:49:25 +0000 (+0100)
Subject: Bug 722161: Clickjacking is possible in "View All" with HTML attachments
X-Git-Tag: bugzilla-4.3.1~103
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=578d62aea57e106bbb79e3c3e6a18aa58fbbe99f;p=thirdparty%2Fbugzilla.git

Bug 722161: Clickjacking is possible in "View All" with HTML attachments
r=dkl a=LpSolit
---

diff --git a/skins/standard/attachment.css b/skins/standard/attachment.css
index b3c21bccf4..3f037c9569 100644
--- a/skins/standard/attachment.css
+++ b/skins/standard/attachment.css
@@ -210,6 +210,11 @@ div#update_container {
     margin-left: 2%;
 }
 
+.viewall_frame {
+    width: 75%;
+    height: 350px;
+}
+
 .details span.bz_private{
   border-left: 1px solid darkred;
   padding-left: 0.5em;
diff --git a/template/en/default/attachment/show-multiple.html.tmpl b/template/en/default/attachment/show-multiple.html.tmpl
index 64b6ce767d..8791e0dfee 100644
--- a/template/en/default/attachment/show-multiple.html.tmpl
+++ b/template/en/default/attachment/show-multiple.html.tmpl
@@ -75,10 +75,22 @@
   </table>
 
   [% IF a.is_viewable %]
-    <iframe src="attachment.cgi?id=[% a.id %]" width="75%" height="350">
-      <b>You cannot view the attachment on this page because your browser does not support IFRAMEs.
-      <a href="attachment.cgi?id=[% a.id %]">View the attachment on a separate page</a>.</b>
-    </iframe>
+    [% IF a.contenttype == "text/html" %]
+      [%# For security reasons (clickjacking, embedded scripts), we never
+        # render HTML pages from here. The source code is displayed instead. %]
+      [% INCLUDE global/textarea.html.tmpl
+         minrows = 10
+         cols    = 80
+         defaultcontent = a.data
+         readonly = 'readonly'
+         classes = 'viewall_frame'
+      %]
+    [% ELSE %]
+      <iframe src="attachment.cgi?id=[% a.id %]" class="viewall_frame">
+        <b>You cannot view the attachment on this page because your browser does not support IFRAMEs.
+        <a href="attachment.cgi?id=[% a.id %]">View the attachment on a separate page</a>.</b>
+      </iframe>
+    [% END %]
   [% ELSE %]
     <p><b>
       Attachment cannot be viewed because its MIME type is not text/*, image/*, or application/vnd.mozilla.*.