UserAward 1.4.1 Addon Security Flaw

ggaudrea

This addon allows anyone to post arbitrary HTML/Javascript into a page by injection via the Notes field when creating an award.

ggaudrea

alert("really?");

Stash

<script>alert("really?");</script>

So, do you have a ptach/fix for the addon? If so, please could you post it here?

ggaudrea

My patch is so bad that I would not dare post it. Of course, I want to help, but I find it very hard to read and understand Vanilla code. It's basically its own language since everything has been wrapped in custom OO code. (That's not a critique, just a poor excuse on my part...)

I just clean the NOTES output with strip_tags() and call it a day. Sorry!

Stash

Please post it, then perhaps someone else can come up with a more elegant solution! Not everyone here is a code wizard (I'm not!) so don't be embarrassed.