Edgewall Software
Modify ↓

Opened 17 years ago

Closed 17 years ago

#6781 closed defect (fixed)

Unchecked input on user prefs

Reported by: trac-ja@… Owned by: Christian Boos
Priority: normal Milestone: 0.11
Component: general Version: 0.11b1
Severity: trivial Keywords:
Cc: trac-ja@… Branch:
Release Notes:
API Changes:
Internal Changes:

Description

A user can register broken data into database and Service denied for the user.

  1. Open Preferences, Keyboard shortcuts.
  2. Change parameter accesskeys's value 1 to XXX by DOM-Inspector.
  3. Push Save changes.

This problem is happend when user is logged in.

Attachments (1)

Trac-0.11b1_inputcheckpref_r382.patch​ (629 bytes ) - added by trac-ja@… 17 years ago.
patch againsts Trac-0.11b1

Download all attachments as: .zip

Change History (3)

by trac-ja@…, 17 years ago

Attachment: Trac-0.11b1_inputcheckpref_r382.patch​ added

patch againsts Trac-0.11b1

comment:1 by Christian Boos, 17 years ago

Owner: changed from Jonas Borgström to Christian Boos
Severity: normal → trivial

comment:2 by Christian Boos, 17 years ago

Resolution: → fixed
Status: new → closed

Patch applied in [6578].

I was not entirely convinced of its usefulness, but as we do a brute force int(session.get('accesskeys', 0)) in a sensitive part of the code, better secure this by normalizing what we write in the session data in the first place.

Modify Ticket

Change Properties
Set your email in Preferences
Action
as closed The owner will remain Christian Boos.
The resolution will be deleted. Next status will be 'reopened'.
to The owner will be changed from Christian Boos to the specified user.

Add Comment
E-mail address and name can be saved in the Preferences .
Attachments ↑ Description ↑
 
Note: See TracTickets for help on using tickets.