full-disclosure - Re: Drupal XML Sitemap 6.x-1.1 XSS Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <928D0D0E-FE78-4B42-8395-1D6D1817431A@gmail.com>
Date: Thu, 15 Oct 2009 18:10:24 -0700
From: Andrew Farmer <andfarm@...il.com>
To: Justin Klein Keane <justin@...irish.net>
Cc: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: Drupal XML Sitemap 6.x-1.1 XSS Vulnerability

On 15 Oct 2009, at 07:24, Justin Klein Keane wrote:
> Applying the following patch mitigates these threats.
>
> - --- site_map/site_map.module    2009-09-30 15:09:49.295134033 -0400
> +++ site_map/site_map.module      2009-09-30 15:09:30.011119976 -0400
> @@ -14,7 +14,7 @@ function site_map_help($path, $arg) {
>  switch ($path) {
>    case 'sitemap':
>      $output = _sitemap_get_message();
> - - -      return $output ? '<p>'. filter_xss($output) .'</p>' : '';
> +      return $output ? '<p>'. $output .'</p>' : '';
>  }
> }

Surely that should be the other way around?

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/