#46667 [Opn->Csd]: TEXTAREA Garbles User Note Editing Form on Master

ID: 46667 Updated by: philip@php.net Reported By: danbrown@php.net -Status: Open +Status: Closed Bug Type: Website problem Operating System: N/A PHP Version: Irrelevant New Comment: Not a major XSS problem (since login is required to get here) but a real problem nevertheless. clean() has been implemented so the textarea should be fine now. Previous Comments: ------------------------------------------------------------------------ [2008-11-29 17:09:35] kalle@php.net I think something like the following patch should do: http://phpfi.com/383500 Without converting html character, we get XSS :) ------------------------------------------------------------------------ [2008-11-28 23:50:05] danbrown@php.net Example: https://master.php.net/note/edit/87304 ------------------------------------------------------------------------ [2008-11-25 16:41:29] danbrown@php.net Description: ------------ When editing user notes on the PHP site via the popup through Master, closing </textarea> tags typed in by the note contributors close out the actual textarea in the form. This causes the remaining code to flow over into parsed HTML below the editable textarea. ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=46667&edit=1