Modify ↓
Ticket #5826 (closed defect: invalid)
Opened 5 years ago
Last modified 5 years ago
ticket submit validation is broken for cnum
| Reported by: | phpxcache@… | Owned by: | jonas |
|---|---|---|---|
| Priority: | normal | Milestone: | |
| Component: | ticket system | Version: | 0.10.4 |
| Severity: | normal | Keywords: | |
| Cc: | |||
| Release Notes: | |||
| API Changes: | |||
Description
spam bots tends to submit data from their own client instead of a browser, and he can forge any data for any fields, and it looks like trac ticket system just accept it and store in db. but how come the ticket system complaint about invalidate data in ticket?
raise InvalidTicket?('Invalid comment threading identifier')
suggested fixes:
- validate data before submit
- when data corrupted/invalidated, trac should ignore it and/or fill a default data.
Attachments
Change History
comment:1 Changed 5 years ago by nkantrowitz
- Resolution set to worksforme
- Status changed from new to closed
comment:2 Changed 5 years ago by phpxcache@…
- Resolution worksforme deleted
- Status changed from closed to reopened
- Summary changed from ticket submit validation to ticket submit validation is broken for cnum
i'm sure it's broken
See http://www.hosted-projects.com/trac/TracDemo/Demo/ticket/295
reproduce
- create ticket
- view the ticket
- save the page html code as 295.htm, and add {{{<base href="http://www.hosted-projects.com/trac/TracDemo/Demo/ticket/295" />
}}} right after <head>
- load 295.htm, fill cnum field with non numeric data
- submit, and view the ticket. gotcha!
comment:3 Changed 5 years ago by phpxcache@…
- Resolution set to invalid
- Status changed from reopened to closed
it seems fixed in 0.10.4
comment:4 Changed 5 years ago by eblot
- Milestone 0.10.5 deleted
Note: See
TracTickets for help on using
tickets.
Data is indeed validated on the way in (http://trac.edgewall.org/browser/trunk/trac/ticket/web_ui.py#L712). Ignoring invalid data when you know it didn't get there via normal channels (since that is checked) is a very bad idea. Generally failures on that end would be due to either manual database operations or corruption. In either case the best option is to alert the user, who can in turn alert an admin. The validation system is also modular (see ITicketManipulator), so you can add new input rules if you need.