Fix #15384: summary.php XSS vulnerability in MantisBT 1.2.12 only

davidhicks · davidhicks · commit 7df30a9ee703 · 2013-01-19T09:58:09.000+11:00
Roland Becker (MantisBT Developer) discovered a XSS vulnerability introduced in MantisBT 1.2.12 with the display of category/project names on the summary.php page. A malicious MantisBT user holding privileged manager/administrator permissions could create a category or project name that contains JavaScript code. Any user visiting summary.php from that point on may then be exposed to having the malicious JavaScript execute within their browser environment. The severity of this issue is limited by the need to hold privileged manager/administrator permissions in order to modify category and project names. However -- there are many use cases where MantisBT installations can have hundreds of sub-projects, each managed by different people/parties that can not or should not be fully trusted. Refer to previous commits 3ca8a16 and 6ec3f69 to trace back the origin of this vulnerability.
diff --git a/core/summary_api.php b/core/summary_api.php
@@ -626,9 +626,9 @@ function summary_print_by_category() {
 		$v_category_name = $row['category_name'];
 
 		if(( $v_category_name != $last_category_name ) && ( $last_category_name != -1 ) ) {
-			$label = $last_category_name;
+			$label = string_display_line( $last_category_name );
 			if(( ON == $t_summary_category_include_project ) && ( ALL_PROJECTS == $t_project_id ) ) {
-				$label = sprintf( '[%s] %s', project_get_name( $last_project ), $label );
+				$label = sprintf( '[%s] %s', string_display_line( project_get_name( $last_project ) ), $label );
 			}
 
 			$t_bug_link = '<a class="subtle" href="' . config_get( 'bug_count_hyperlink_prefix' ) . '&amp;' . FILTER_PROPERTY_CATEGORY . '=' . urlencode( $last_category_name );
@@ -671,9 +671,9 @@ function summary_print_by_category() {
 	}
 
 	if( 0 < $t_bugs_total ) {
-		$label = $last_category_name;
+		$label = string_display_line( $last_category_name );
 		if(( ON == $t_summary_category_include_project ) && ( ALL_PROJECTS == $t_project_id ) ) {
-			$label = sprintf( '[%s] %s', project_get_name( $last_project ), $label );
+			$label = sprintf( '[%s] %s', string_display_line( project_get_name( $last_project ) ), $label );
 		}
 
 		$t_bug_link = '<a class="subtle" href="' . config_get( 'bug_count_hyperlink_prefix' ) . '&amp;' . FILTER_PROPERTY_CATEGORY . '=' . urlencode( $last_category_name );
@@ -753,7 +753,7 @@ function summary_print_by_project( $p_projects = null, $p_level = 0, $p_cache =
 	}
 
 	foreach( $p_projects as $t_project ) {
-		$t_name = str_repeat( "&raquo; ", $p_level ) . project_get_name( $t_project );
+		$t_name = str_repeat( "&raquo; ", $p_level ) . string_display_line( project_get_name( $t_project ) );
 
 		$t_pdata = isset( $p_cache[$t_project] ) ? $p_cache[$t_project] : array( 'open' => 0, 'resolved' => 0, 'closed' => 0 );
 

Original file line number	Diff line number	Diff line change
`@@ -626,9 +626,9 @@ function summary_print_by_category() {`
`626`	`626`	`$v_category_name = $row['category_name'];`
`627`	`627`
`628`	`628`	`if(( $v_category_name != $last_category_name ) && ( $last_category_name != -1 ) ) {`
`629`		`- $label = $last_category_name;`
	`629`	`+ $label = string_display_line( $last_category_name );`
`630`	`630`	`if(( ON == $t_summary_category_include_project ) && ( ALL_PROJECTS == $t_project_id ) ) {`
`631`		`- $label = sprintf( '[%s] %s', project_get_name( $last_project ), $label );`
	`631`	`+ $label = sprintf( '[%s] %s', string_display_line( project_get_name( $last_project ) ), $label );`
`632`	`632`	`}`
`633`	`633`
`634`	`634`	`$t_bug_link = '<a class="subtle" href="' . config_get( 'bug_count_hyperlink_prefix' ) . '&' . FILTER_PROPERTY_CATEGORY . '=' . urlencode( $last_category_name );`
`@@ -671,9 +671,9 @@ function summary_print_by_category() {`
`671`	`671`	`}`
`672`	`672`
`673`	`673`	`if( 0 < $t_bugs_total ) {`
`674`		`- $label = $last_category_name;`
	`674`	`+ $label = string_display_line( $last_category_name );`
`675`	`675`	`if(( ON == $t_summary_category_include_project ) && ( ALL_PROJECTS == $t_project_id ) ) {`
`676`		`- $label = sprintf( '[%s] %s', project_get_name( $last_project ), $label );`
	`676`	`+ $label = sprintf( '[%s] %s', string_display_line( project_get_name( $last_project ) ), $label );`
`677`	`677`	`}`
`678`	`678`
`679`	`679`	`$t_bug_link = '<a class="subtle" href="' . config_get( 'bug_count_hyperlink_prefix' ) . '&' . FILTER_PROPERTY_CATEGORY . '=' . urlencode( $last_category_name );`
`@@ -753,7 +753,7 @@ function summary_print_by_project( $p_projects = null, $p_level = 0, $p_cache =`
`753`	`753`	`}`
`754`	`754`
`755`	`755`	`foreach( $p_projects as $t_project ) {`
`756`		`- $t_name = str_repeat( "» ", $p_level ) . project_get_name( $t_project );`
	`756`	`+ $t_name = str_repeat( "» ", $p_level ) . string_display_line( project_get_name( $t_project ) );`
`757`	`757`
`758`	`758`	`$t_pdata = isset( $p_cache[$t_project] ) ? $p_cache[$t_project] : array( 'open' => 0, 'resolved' => 0, 'closed' => 0 );`
`759`	`759`