Mercurial > p > roundup > code
view website/issues/html/user.forgotten.html @ 8062:28aa76443f58
fix(security): fix CVE-2024-39124, CVE-2024-39124, and CVE-2024-39125
Directions for fixing:
* `CVE-2024-39124`_ - :ref:`classhelpers (_generic.help.html) are
vulnerable to an XSS attack. <CVE-2024-39124>` Requires fixing
tracker homes.
* `CVE-2024-39125`_ - :ref:`if Referer header is set to a script
tag, it will be executed. <CVE-2024-39125>` Fixed in release 2.4.0,
directions available for fixing in prior versions.
* `CVE-2024-39126`_ - :ref:`PDF, XML and SVG files downloaded from
an issue can contain embedded JavaScript which is
executed. <CVE-2024-39126>` Fixed in release 2.4.0, directions
available for fixing in prior versions.
prior to 2.4.0 release this weekend that fixes the last two CVE's.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Tue, 09 Jul 2024 09:07:09 -0400 |
| parents | 53e9694788f5 |
| children |
line wrap: on
line source
<tal:block metal:use-macro="templates/page/macros/icing"> <title metal:fill-slot="head_title" i18n:translate="">Password reset request - <span i18n:name="tracker" tal:replace="config/TRACKER_NAME" /></title> <span metal:fill-slot="body_title" tal:omit-tag="python:1" i18n:translate="">Password reset request</span> <td class="content" metal:fill-slot="content"> <tal:askforinfo tal:condition="python:options['error_message'] or '@action' not in request.form"> <p i18n:translate="">You have two options if you have forgotten your password. If you know the email address you registered with, enter it below.</p> <p i18n:translate="">If your user was automatically created during import from the old sourceforge tracker, your e-mail address is <Sourceforge username>@users.sourceforge.net. The mail address associated with your account can be changed after login.</p> <form method="POST" onSubmit="return submit_once()" tal:attributes="action context/designator"> <table class="form"> <tr> <th i18n:translate="">Email Address:</th> <td><input name="address"></td> </tr> <tr> <td> </td> <td> <input type="hidden" name="@action" value="passrst"> <input type="hidden" name="@template" value="forgotten"> <input type="submit" value="Request password reset" i18n:attributes="value"> <input name="@csrf" type="hidden" tal:attributes="value python:utils.anti_csrf_nonce()"> </td> </tr> </table> <p i18n:translate="">Or, if you know your username, then enter it below.</p> <p i18n:translate="">If you have previously created or modified issue reports in the sourceforge issue tracker, you have an account here with the same username as your sourceforge username.</p> <table class="form"> <tr><th i18n:translate="">Username:</th> <td><input name="username"></td> </tr> <tr><td></td><td><input type="submit" value="Request password reset" i18n:attributes="value"></td></tr> </table> </form> <p i18n:translate="">A confirmation email will be sent to you - please follow the instructions within it to complete the reset process.</p> </tal:askforinfo> </td> g </tal:block>
