Re: [pear-webmaster] rasmus's magic tool
| From: | Helgi Þormar | Date: | Wed, 01 Jun 2005 23:40:05 +0000 |
| Subject: | Re: [pear-webmaster] rasmus's magic tool | ||
| References: | 1 2 3 | Groups: | php.pear.webmaster |
| Request: | Send a blank email to pear-webmaster+get-4122@lists.php.net to get a copy of this message | ||
On Thu, 2005-06-02 at 01:27 +0200, Martin Jansen wrote:
> On Mon May 09, 2005 at 08:0337AM +0000, Helgi Þormar wrote:
> > On Mon, 2005-05-09 at 01:10 -0400, Lukas Smith wrote:
> > > [01:07] <Rasmus> This is the output from running it on the top page of
> > > pear.php.net
> > > [01:07] <Rasmus> get
> > > http://pear.php.net//<test_xss>/?
> > > [01:07] <Rasmus> Raw tags are echoed back unfiltered
> > > [01:07] <Rasmus> <p>The requested document
> > > <i>//<test_xss>
> > > [01:08] <Rasmus> might want to htmlentity that
> >
> > Thanks, I've been doing a bit cleanup, backporting Rasmus fixes to
> > bugsweb over to pear and peclweb plus some other fixes, will look into
> > this one also if it's not fixed already.
>
> What's the status on this? Will you be able to fix it in a reasonable
> timeframe?
I've committed a lot of fixes for this, so we are somewhat safe, I think
I have more improvements in my local checkout, for the bug system and
other stuff I already did, just it's been a crazy month for me, I'll try
to find time to look into this stuff better very soon.
- Helgi