Uploaded image for project: 'Observium'
  1. Observium
  2. OBS-1882

CLONE - Restore ability to use HTML in login_message

Details

    • Bug
    • Resolution: Incomplete
    • Minor
    • None
    • Professional Edition
    • Web Interface
    • None

    Description

      Revision 6273 added escape_html() to login_message, removing our ability to use HTML in the login warning.

      Please revert this change:

      @@-83,7 +83,7@@

      if (isset($config['login_message']))

      { - echo('<div class=row><div class="col-md-6 col-md-offset-3"><div style="margin-top: 10px;text-align: center; font-weight: bold; color: #cc0000;">'.$config['login_message'].'</div></div></div>'); + echo('<div class=row><div class="col-md-6 col-md-offset-3"><div style="margin-top: 10px;text-align: center; font-weight: bold; color: #cc0000;">'.escape_html($config['login_message']).'</div></div></div>'); }

      ?>
      <script type="text/javascript">

      Attachments

        Issue Links

          clones

          Bug - A problem which impairs or prevents the functions of the product. OBS-1308 Restore ability to use HTML in login_message

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Closed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. OBS-1821 Security issues: CSRF, Persistent XSS, Authenticated RCE

          • Major - Major loss of function.
          • Closed

          Activity

            [OBS-1882] CLONE - Restore ability to use HTML in login_message
            landy Mike Stupalov made changes -
            Status Original: Resolved [ 5 ] New: Closed [ 6 ]
            davidc David Croft added a comment -

            Escaping user input is appropriate. Escaping content in the name of security when ONLY the administrator could have defined it in the first place is not.
            If you truly don't trust your own users to put appropriate values in the config file (which bearing in mind they can override as I have done just by editing the PHP file), then why not add an additional variable login_message_html.

            David

            davidc David Croft added a comment - Escaping user input is appropriate. Escaping content in the name of security when ONLY the administrator could have defined it in the first place is not. If you truly don't trust your own users to put appropriate values in the config file (which bearing in mind they can override as I have done just by editing the PHP file), then why not add an additional variable login_message_html. David
            landy Mike Stupalov made changes -
            Resolution New: Incomplete [ 4 ]
            Status Original: Pending Response [ 10000 ] New: Resolved [ 5 ]
            landy Mike Stupalov added a comment -

            No response for a long time.

            landy Mike Stupalov added a comment - No response for a long time.
            landy Mike Stupalov made changes -
            Status Original: Open [ 1 ] New: Pending Response [ 10000 ]
            landy Mike Stupalov made changes -
            Link New: This issue relates to OBSERVIUM-1821 [ OBSERVIUM-1821 ]
            landy Mike Stupalov made changes -
            Assignee Original: Adam Armstrong [ adama ] New: Mike Stupalov [ landy ]
            landy Mike Stupalov added a comment -

            This "ability" complete removed for security reasons.

            Why and what exactly you want here in this message box?

            escape not be deleted, but if you show me real case what you want here, I will think how to solve it.

            landy Mike Stupalov added a comment - This "ability" complete removed for security reasons. Why and what exactly you want here in this message box? escape not be deleted, but if you show me real case what you want here, I will think how to solve it.
            davidc David Croft added a comment -

            This was broken again in r7789

            davidc David Croft added a comment - This was broken again in r7789
            davidc David Croft made changes -
            Link New: This issue clones OBSERVIUM-1308 [ OBSERVIUM-1308 ]

            People

              landy Mike Stupalov
              davidc David Croft
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: