Mercurial > p > roundup > code
annotate website/issues/html/home.about.html @ 8062:28aa76443f58
fix(security): fix CVE-2024-39124, CVE-2024-39124, and CVE-2024-39125
Directions for fixing:
* `CVE-2024-39124`_ - :ref:`classhelpers (_generic.help.html) are
vulnerable to an XSS attack. <CVE-2024-39124>` Requires fixing
tracker homes.
* `CVE-2024-39125`_ - :ref:`if Referer header is set to a script
tag, it will be executed. <CVE-2024-39125>` Fixed in release 2.4.0,
directions available for fixing in prior versions.
* `CVE-2024-39126`_ - :ref:`PDF, XML and SVG files downloaded from
an issue can contain embedded JavaScript which is
executed. <CVE-2024-39126>` Fixed in release 2.4.0, directions
available for fixing in prior versions.
prior to 2.4.0 release this weekend that fixes the last two CVE's.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Tue, 09 Jul 2024 09:07:09 -0400 |
| parents | 4155ed7f00f4 |
| children |
| rev | line source |
|---|---|
| 6246 | 1 <!-- dollarId: issue.index,v 1.2 2001/07/29 04:07:37 richard Exp dollar--> |
| 2 | |
| 3 <tal:block metal:use-macro="templates/page/macros/icing"> | |
| 4 | |
| 5 <title metal:fill-slot="head_title" i18n:translate="" > | |
| 6 About this Tracker | |
| 7 </title> | |
| 8 <tal:block metal:fill-slot="body_title" i18n:translate=""> | |
| 9 About this Tracker | |
| 10 </tal:block> | |
| 11 | |
| 12 <div class="content" metal:fill-slot="content"> | |
| 13 | |
| 14 <span tal:condition="not:python:request.user.hasRole('Admin')" | |
| 15 tal:omit-tag="python:1" i18n:translate=""> | |
| 16 Please login with your username and password to find out about | |
| 17 this tracker. | |
| 18 </span> | |
| 19 | |
| 20 <div tal:condition="python:request.user.hasRole('Admin')" | |
| 21 tal:omit-tag="python:1" i18n:translate=""> | |
| 22 <div tal:replace="structure python:utils.AboutPage(db)"></div> | |
| 23 </div> | |
| 24 </div> | |
| 25 | |
| 26 </tal:block> |