Mercurial > p > roundup > code
view website/issues/html/style.css @ 8357:abf1297e7a94
bug(security): fix XSS exploit in devel and responsive templates
Replace all occurances of:
tal:content="structure context/MUMBLE/plain"
with
tal:content="context/MUMBLE/plain"
This seems to have been an old way to handle display of a field when
the user did not have edit rights. It does not occur in current (later
than 2009) classic tracker templates. But probably was unsed in
earlier classic templates since devel, reponsive and the roundup issue
tracker templates were based on classic.
Add CVE placeholder to security.txt and link to fix directions added
to upgrading.txt. Add note in announcement.txt and CHANGES.txt
Add a details element around the table of contents in the upgrading
guide. It was getting long.
Updated a missed XSS issue in the roundup tracker template. Live site
is already fixed.
XSS bug reported by 4bug of ChaMd5 Security Team H1 Group
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Tue, 08 Jul 2025 13:38:08 -0400 |
| parents | 10a8a6bc4667 |
| children |
line wrap: on
line source
/* This is a copy of main Roundup website style.css from website/www/_static/style.css in source repository. */ /* layout*/ body { font-family: sans-serif, Arial, Helvetica; background-color: white; color: #333; margin:0; padding: 0 3em 0 13em; } body > .header { margin: 0 0 0 -13em;} body > .footer { margin: 0 0 0 -13em; clear:both;} body > .navigation { margin-left: -13em; width: 13em; float: left; } body > .content { width: 100%; margin: 0; } body > .header > #searchbox { position: absolute; right: 1em; top: 1em;} /* style */ :link { color: #bb0000; text-decoration: none;} :visited { color: #770000; text-decoration: none;} .header h1 { margin-left: 1em; } body { font-family: sans-serif, Arial, Helvetica; background-color: #f5f5f5; color: #333; } .menu { padding: 0; margin-right: 1em;} .menu ul { padding: 0; margin: 0; } .menu li { margin: 5pt 0; } .menu > ul > li > * { display: block; padding: 2pt 2pt 2pt 10pt; border: solid thin #dadada; background-color:#ffffff; } .menu > ul > li.current > * { background-color:#dddddd; } .menu ul li:first-child { margin-top:0;} .menu ul { list-style-type:none;} /* sub-menus are indented */ .menu > ul > li > ul, .menu > ul > li.current > ul { border: none; background-color: inherit; margin: 0; } .menu ul ul { margin-left: 2em; font-size: smaller; margin: 0 0 0 5pt; } /* sub-menu items draw a separator */ .menu ul ul > li { margin: 0; padding: 0; border: none; border-top: solid thin #dadada; background-color: inherit; } .menu ul ul > li:first-child { border-top: none; } .footer { font-size: small; text-align: center; color: black; } .content { padding: 1em; border: solid thin #dadada; background-color: #ffffff; } pre { white-space: pre-wrap; } #search { text-align: right; } p.ok-message { background-color: #eeffee; border: 1px solid #009900; padding: 5px; color: #009900; font-weight: bold; } p.error-message { background-color: #ffeeee; border: 1px solid #990000; padding: 5px; color: #990000; font-weight: bold; } /* This is a little hack to inject a 'news' block into the title page without having to set up a custom directive. */ #roundup-issue-tracker .note { float: right; width: auto; border: solid thin #dadada; background-color:#f5f5f5; padding: 1em; margin: 1em; } #roundup-issue-tracker .note .admonition-title { display: none; } table { border-collapse: collapse; border-spacing: 1px; background-color: #fafafa; } table:not(.list) th { text-align: left; padding-block-end: 0.75em; } table textarea { width: 99%; } table th[colspan] { text-align: center; } /* Need some space between content of Issue List columns */ td, th { padding-left: 1em; vertical-align: top; } tr.odd { background-color:#f5f5f5; } /* widen tables since headers have a lot of info and are squished and difficult to read */ table.messages, table.files { width: 95%; } /* Make sure that user name starts at the top of the change list and not in the middle Issue2550809: History display misalignment */ table.history td { vertical-align: top; } /* similar issue as above with history table. Align labels to the left at the top of possible multiline description and other columns */ table.classhelp td { vertical-align: top; } .required:before { content: "*"; color: red; font-weight: bold; } /* SHA: 2a5330c3d1ee6bf31e672e1c8a9317d11b7eb436 */
