Modify ↓
#5826 closed defect (invalid)
ticket submit validation is broken for cnum
| Reported by: | Owned by: | Jonas Borgström | |
|---|---|---|---|
| Priority: | normal | Milestone: | |
| Component: | ticket system | Version: | 0.10.4 |
| Severity: | normal | Keywords: | |
| Cc: | Branch: | ||
| Release Notes: | |||
| API Changes: | |||
| Internal Changes: | |||
Description
spam bots tends to submit data from their own client instead of a browser, and he can forge any data for any fields, and it looks like trac ticket system just accept it and store in db. but how come the ticket system complaint about invalidate data in ticket?
raise InvalidTicket('Invalid comment threading identifier')
suggested fixes:
- validate data before submit
- when data corrupted/invalidated, trac should ignore it and/or fill a default data.
Attachments (0)
Change History (4)
comment:1 by , 17 years ago
| Resolution: | → worksforme |
|---|---|
| Status: | new → closed |
comment:2 by , 17 years ago
| Resolution: | worksforme |
|---|---|
| Status: | closed → reopened |
| Summary: | ticket submit validation → ticket submit validation is broken for cnum |
i'm sure it's broken
See http://www.hosted-projects.com/trac/TracDemo/Demo/ticket/295
reproduce
- create ticket
- view the ticket
- save the page html code as 295.htm, and add {{{<base href="http://www.hosted-projects.com/trac/TracDemo/Demo/ticket/295" />
}}} right after <head>
- load 295.htm, fill cnum field with non numeric data
- submit, and view the ticket. gotcha!
comment:3 by , 17 years ago
| Resolution: | → invalid |
|---|---|
| Status: | reopened → closed |
it seems fixed in 0.10.4
comment:4 by , 17 years ago
| Milestone: | 0.10.5 |
|---|
Note:
See TracTickets
for help on using tickets.
Data is indeed validated on the way in (http://trac.edgewall.org/browser/trunk/trac/ticket/web_ui.py#L712). Ignoring invalid data when you know it didn't get there via normal channels (since that is checked) is a very bad idea. Generally failures on that end would be due to either manual database operations or corruption. In either case the best option is to alert the user, who can in turn alert an admin. The validation system is also modular (see ITicketManipulator), so you can add new input rules if you need.