http://hg.code.sf.net:8000/p/roundup/code/atom-log/tip/share/roundup/templates/devel/html/msg.item.html Mercurial Repository: p/roundup/code: share/roundup/templates/devel/html/msg.item.html history 2025-07-11T19:30:27-04:00 bug(security): CVE-2025-53865 - XSS bug http://hg.code.sf.net:8000/p/roundup/code/#changeset-4ac0bbb3e440678d1f591777ceb5b43e360d3d25 John Rouillard rouilj@ieee.org 2025-07-11T19:30:27-04:00 2025-07-11T19:30:27-04:00
changeset 4ac0bbb3e440
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description bug(security): CVE-2025-53865 - XSS bug

Extensive fixes in devel, responsive templates known to be
exploitable.

Similar constructs in classic and minimal templates not known
to be exploitable, but changed anyway.

doc/upgrading.txt:

Reformat to 66 characters.

Update with assigned CVE number.

Add section on fixing tal:replace with unsafe data.

Document analysis and assumptions in comment in file.

doc/security.txt:

Update with CVE number.
files
changes to try to deploy anti-csrf defense to other templates. http://hg.code.sf.net:8000/p/roundup/code/#changeset-4a157824f9337db137ab7ca1b5bde4234f11c4a7 John Rouillard rouilj@ieee.org 2017-03-18T23:36:02-04:00 2017-03-18T23:36:02-04:00
changeset 4a157824f933
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description changes to try to deploy anti-csrf defense to other templates.
files
[gsoc-2009] Add new tracker template sandbox. http://hg.code.sf.net:8000/p/roundup/code/#changeset-115e9883311e2659e6a8029909628daefa297cce Stefan Seefeld stefan@seefeld.name 2009-06-02T00:41:57+00:00 2009-06-02T00:41:57+00:00
changeset 115e9883311e
branch gsoc-2009
bookmark
tag
user Stefan Seefeld <stefan@seefeld.name>
description Add new tracker template sandbox.
files