Avoiding to be erased and redirection
jamarier - May 27, 2006 - 06:38
| Project: | TrackBack |
| Version: | 4.6.x-1.x-dev |
| Component: | Other |
| Category: | bug report |
| Priority: | normal |
| Assigned: | Unassigned |
| Status: | active |
Jump to:
Description
Today i try to erase a spam trackback and I cant. It is because the text of trackback has at the end a 'a' tag without closing it (and without text). The Confirm erase button is next to text and It become a button to that link and lose its funcionality of submit form.
efects:
- the button of confirm erase is made unusable
- the atacker can redirect to anywhere page with sesión and cookies of admin
I suppose is a general problem of every text field, but i cant probe it
page attached
(to erase i had to save that page in HD, modify formaction an del open a tag)
| Attachment | Size |
|---|---|
| 3.htm.txt | 4.89 KB |
#1
I solved swapping 2 lines in trackback.module:
from:
drupal_set_message(t('Do you want to delete this trackback?'));
$output .= theme('trackback',$trackback_received,FALSE);
$output .= form(form_submit(t('Delete')));
print theme('page',$output);
to:
drupal_set_message(t('Do you want to delete this trackback?'));
$output .= form(form_submit(t('Delete')));
$output .= theme('trackback',$trackback_received,FALSE);
print theme('page',$output);