In modules/abuse/abuse-report.tpl.php
Need replace strigs:
- print l($object->title, $object->path['URL'], array('html' => TRUE, 'query' => $object->path['QUERY'], 'fragment' => $object->path['BREADCRUMB']));
+ print l(filter_xss_admin($object->title), $object->path['URL'], array('html' => TRUE, 'query' => $object->path['QUERY'], 'fragment' => $object->path['BREADCRUMB']));

-

print $object->description;

+

print filter_xss_admin($object->description);

CommentFileSizeAuthor
#2 rep_steps.png14.11 KBMAMONT
#2 rep_steps2.png3.77 KBMAMONT
1019x362.orig_.jpg23.81 KBMAMONT
732x346.orig_.jpg26.3 KBMAMONT

Comments

MAMONT’s picture

MAMONT commented

Small correction.
print l(check_plain($object->title), $object->path['URL'], array('html' => TRUE, 'query' => $object->path['QUERY'], 'fragment' => $object->path['BREADCRUMB']));

In H2 don't use filter_xss_admin, please use check_plain.

MAMONT’s picture

MAMONT commented
StatusFileSize
new rep_steps2.png3.77 KB
new rep_steps.png14.11 KB

Steps to reproduce.
1. Create a new node with

alert('xss1');

in title and

alert('xss2');

in body.
2. Click to 'Flag as offensive'.
3. Go to admin/content/abuse.

jcisio’s picture

jcisio commented

It's easier to remove 'html' => TRUE, isn't it?

MAMONT’s picture

MAMONT commented

Fixed in http://drupal.org/node/1127046

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
Issue tags: +Security improvements

tagging

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented

Subscribe.

I agree with jcisio in #3 on that one particular section of code it is clearer to simply remove the html => true.

jcisio’s picture

jcisio commented
Status: Active » Fixed

I committed in both 1.x and 2.x branch. A new official release for 1.x branch has been out. I'm quite busy and don't have time for other fixes in this release.

Automatically closed -- issue fixed for 2 weeks with no activity.