#1054 [NEW]: SECURITY: critical - bug system does not escape HTML in titles
| From: | alan at akbkhome dot com | Date: | Mon, 22 Mar 2004 14:36:45 +0000 |
| Subject: | #1054 [NEW]: SECURITY: critical - bug system does not escape HTML in titles | ||
| Groups: | php.pear.dev | ||
| Request: | Send a blank email to pear-dev+get-26624@lists.php.net to get a copy of this message | ||
From: alan at akbkhome dot com
Operating system: na
PHP version: 4.3.4
PHP Bug Type: Bug System
Bug description: SECURITY: critical - bug system does not escape HTML in titles
Description:
------------
submitting a bug to HTML_javascript produces a search result with a bug on
Flexy that as <textarea> in the title..
- this appears as a text area..
- we are suceptable to cross site scripting!!!!!!!
** need to htmlspecialchars title !
--
Edit bug report at http://pear.php.net/bugs/bug.php?id=1054&edit=1
--