http://hg.code.sf.net:8000/p/roundup/code/atom-log/tip/share/roundup/templates/devel/html/task.item.html Mercurial Repository: p/roundup/code: share/roundup/templates/devel/html/task.item.html history 2025-07-11T19:30:27-04:00 bug(security): CVE-2025-53865 - XSS bug http://hg.code.sf.net:8000/p/roundup/code/#changeset-4ac0bbb3e440678d1f591777ceb5b43e360d3d25 John Rouillard rouilj@ieee.org 2025-07-11T19:30:27-04:00 2025-07-11T19:30:27-04:00
changeset 4ac0bbb3e440
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description bug(security): CVE-2025-53865 - XSS bug

Extensive fixes in devel, responsive templates known to be
exploitable.

Similar constructs in classic and minimal templates not known
to be exploitable, but changed anyway.

doc/upgrading.txt:

Reformat to 66 characters.

Update with assigned CVE number.

Add section on fixing tal:replace with unsafe data.

Document analysis and assumptions in comment in file.

doc/security.txt:

Update with CVE number.
files
bug(security): fix XSS exploit in devel and responsive templates http://hg.code.sf.net:8000/p/roundup/code/#changeset-abf1297e7a940f7bbe42fed4e319d9de96cdc740 John Rouillard rouilj@ieee.org 2025-07-08T13:38:08-04:00 2025-07-08T13:38:08-04:00
changeset abf1297e7a94
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description bug(security): fix XSS exploit in devel and responsive templates

Replace all occurances of:

tal:content="structure context/MUMBLE/plain"

with

tal:content="context/MUMBLE/plain"

This seems to have been an old way to handle display of a field when
the user did not have edit rights. It does not occur in current (later
than 2009) classic tracker templates. But probably was unsed in
earlier classic templates since devel, reponsive and the roundup issue
tracker templates were based on classic.

Add CVE placeholder to security.txt and link to fix directions added
to upgrading.txt. Add note in announcement.txt and CHANGES.txt

Add a details element around the table of contents in the upgrading
guide. It was getting long.

Updated a missed XSS issue in the roundup tracker template. Live site
is already fixed.

XSS bug reported by 4bug of ChaMd5 Security Team H1 Group
files
changes to try to deploy anti-csrf defense to other templates. http://hg.code.sf.net:8000/p/roundup/code/#changeset-4a157824f9337db137ab7ca1b5bde4234f11c4a7 John Rouillard rouilj@ieee.org 2017-03-18T23:36:02-04:00 2017-03-18T23:36:02-04:00
changeset 4a157824f933
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description changes to try to deploy anti-csrf defense to other templates.
files
Add missing 'property' argument to classhelp call. http://hg.code.sf.net:8000/p/roundup/code/#changeset-2860ff541d0ecdb4a7dc4c407769ffb7a510c309 Stefan Seefeld stefan@seefeld.name 2010-11-04T17:52:07+00:00 2010-11-04T17:52:07+00:00
changeset 2860ff541d0e
branch
bookmark
tag
user Stefan Seefeld <stefan@seefeld.name>
description Add missing 'property' argument to classhelp call.
files
[gsoc-2009] Add new tracker template sandbox. http://hg.code.sf.net:8000/p/roundup/code/#changeset-115e9883311e2659e6a8029909628daefa297cce Stefan Seefeld stefan@seefeld.name 2009-06-02T00:41:57+00:00 2009-06-02T00:41:57+00:00
changeset 115e9883311e
branch gsoc-2009
bookmark
tag
user Stefan Seefeld <stefan@seefeld.name>
description Add new tracker template sandbox.
files