Susceptible to spammy redirects

[anonymous]

Spammers upload attachments, then spamvertize them (typically comment spamming on blogs etc) with ?format=raw behind the URL. Then the redirects work.

Spammy redirects using holes in software is the new spam technique, and needs to be plugged wherever the hole is used.

Details here: http://spamhuntress.com/2006/09/07/trac-ticket-system-susceptible-to-redirects/

[cboos]

Live from irc:

<cboos> actually, when I tried to see them, I could see the source, but trying to view the "Original Format" redirected me to some other point in the web... The spam html files did contain <script> tags, and the javascript code must have done the redirect <cboos> ... so probably lighthttpd has the render_unsafe_content flag set to true ... or there's a problem with that part of the code

We should check whether the render_unsafe_content TracIni#attachment flag works as expected.

[mgood]

I just verified with one of the Lighttpd admins that render_unsafe_content was set to true, so this just seems to be a config issue.