Skip to content

Commit 5155f02

Browse files
unknwonunknwon
committed
Security: fix XSS attack on milestone
Reported by Miguel Ángel Jimeno.
1 parent d521e71 commit 5155f02

File tree

6 files changed

+17
-13
lines changed

6 files changed

+17
-13
lines changed

‎gogs.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ import (
1616
"github.com/gogits/gogs/modules/setting"
1717
)
1818

19-
const APP_VER = "0.9.152.0216"
19+
const APP_VER = "0.9.153.0217"
2020

2121
func init() {
2222
setting.AppVer = APP_VER

‎routers/repo/http.go

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -95,15 +95,19 @@ func HTTPContexter() macaron.Handler {
9595

9696
authUser, err := models.UserSignIn(authUsername, authPassword)
9797
if err != nil && !models.IsErrUserNotExist(err) {
98-
ctx.Handle(http.StatusInternalServerError, "UserSignIn: %v", err)
98+
ctx.Handle(http.StatusInternalServerError, "UserSignIn", err)
9999
return
100100
}
101101

102102
// If username and password combination failed, try again using username as a token.
103103
if authUser == nil {
104104
token, err := models.GetAccessTokenBySHA(authUsername)
105105
if err != nil {
106-
ctx.NotFoundOrServerError("GetAccessTokenBySHA", models.IsErrAccessTokenNotExist, err)
106+
if models.IsErrAccessTokenEmpty(err) || models.IsErrAccessTokenNotExist(err) {
107+
ctx.Error(http.StatusUnauthorized)
108+
} else {
109+
ctx.Handle(http.StatusInternalServerError, "GetAccessTokenBySHA", err)
110+
}
107111
return
108112
}
109113
token.Updated = time.Now()

‎templates/.VERSION

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
0.9.152.0216
1+
0.9.153.0217

‎templates/repo/issue/list.tmpl

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@
3333
<div class="menu">
3434
<a class="item" href="{{$.Link}}?type={{$.ViewType}}&sort={{$.SortType}}&state={{$.State}}&milestone={{$.MilestoneID}}&assignee={{$.AssigneeID}}">{{.i18n.Tr "repo.issues.filter_label_no_select"}}</a>
3535
{{range .Labels}}
36-
<a class="item" href="{{$.Link}}?type={{$.ViewType}}&sort={{$.SortType}}&state={{$.State}}&labels={{.ID}}&milestone={{$.MilestoneID}}&assignee={{$.AssigneeID}}"><span class="octicon {{if eq $.SelectLabels .ID}}octicon-check{{end}}"></span><span class="label color" style="background-color: {{.Color}}"></span> {{.Name}}</a>
36+
<a class="item" href="{{$.Link}}?type={{$.ViewType}}&sort={{$.SortType}}&state={{$.State}}&labels={{.ID}}&milestone={{$.MilestoneID}}&assignee={{$.AssigneeID}}"><span class="octicon {{if eq $.SelectLabels .ID}}octicon-check{{end}}"></span><span class="label color" style="background-color: {{.Color}}"></span> {{.Name | Sanitize}}</a>
3737
{{end}}
3838
</div>
3939
</div>
@@ -47,7 +47,7 @@
4747
<div class="menu">
4848
<a class="item" href="{{$.Link}}?type={{$.ViewType}}&sort={{$.SortType}}&state={{$.State}}&labels={{.SelectLabels}}&assignee={{$.AssigneeID}}">{{.i18n.Tr "repo.issues.filter_milestone_no_select"}}</a>
4949
{{range .Milestones}}
50-
<a class="{{if eq $.MilestoneID .ID}}active selected{{end}} item" href="{{$.Link}}?type={{$.ViewType}}&sort={{$.SortType}}&state={{$.State}}&labels={{$.SelectLabels}}&milestone={{.ID}}&assignee={{$.AssigneeID}}">{{.Name}}</a>
50+
<a class="{{if eq $.MilestoneID .ID}}active selected{{end}} item" href="{{$.Link}}?type={{$.ViewType}}&sort={{$.SortType}}&state={{$.State}}&labels={{$.SelectLabels}}&milestone={{.ID}}&assignee={{$.AssigneeID}}">{{.Name | Sanitize}}</a>
5151
{{end}}
5252
</div>
5353
</div>
@@ -105,7 +105,7 @@
105105
<a class="title has-emoji" href="{{$.Link}}/{{.Index}}">{{.Title}}</a>
106106

107107
{{range .Labels}}
108-
<a class="ui label" href="{{$.Link}}?type={{$.ViewType}}&state={{$.State}}&labels={{.ID}}&milestone={{$.MilestoneID}}&assignee={{$.AssigneeID}}" style="color: {{.ForegroundColor}}; background-color: {{.Color}}">{{.Name}}</a>
108+
<a class="ui label" href="{{$.Link}}?type={{$.ViewType}}&state={{$.State}}&labels={{.ID}}&milestone={{$.MilestoneID}}&assignee={{$.AssigneeID}}" style="color: {{.ForegroundColor}}; background-color: {{.Color}}">{{.Name | Sanitize}}</a>
109109
{{end}}
110110

111111
{{if .NumComments}}
@@ -116,7 +116,7 @@
116116
{{$.i18n.Tr "repo.issues.opened_by" $timeStr .Poster.HomeLink .Poster.Name | Safe}}
117117
{{if .Milestone}}
118118
<a class="milestone" href="{{$.Link}}?type={{$.ViewType}}&state={{$.State}}&labels={{$.SelectLabels}}&milestone={{.Milestone.ID}}&assignee={{$.AssigneeID}}">
119-
<span class="octicon octicon-milestone"></span> {{.Milestone.Name}}
119+
<span class="octicon octicon-milestone"></span> {{.Milestone.Name | Sanitize}}
120120
</a>
121121
{{end}}
122122
{{if .Assignee}}

‎templates/repo/issue/milestones.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626
<div class="milestone list">
2727
{{range .Milestones}}
2828
<li class="item">
29-
<i class="octicon octicon-milestone"></i> <a href="{{$.RepoLink}}/issues?state={{$.State}}&milestone={{.ID}}">{{.Name}}</a>
29+
<i class="octicon octicon-milestone"></i> <a href="{{$.RepoLink}}/issues?state={{$.State}}&milestone={{.ID}}">{{.Name | Sanitize}}</a>
3030
<div class="ui right green progress" data-percent="{{.Completeness}}">
3131
<div class="bar" {{if not .Completeness}}style="background-color: transparent"{{end}}>
3232
<div class="progress"></div>

‎templates/repo/issue/view_content.tmpl

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -272,7 +272,7 @@
272272
<span class="no-select item {{if .HasSelectedLabel}}hide{{end}}">{{.i18n.Tr "repo.issues.new.no_label"}}</span>
273273
{{range .Labels}}
274274
<div class="item">
275-
<a class="ui label {{if not .IsChecked}}hide{{end}}" id="label_{{.ID}}" href="{{$.RepoLink}}/issues?labels={{.ID}}" style="color: {{.ForegroundColor}}; background-color: {{.Color}}">{{.Name}}</a>
275+
<a class="ui label {{if not .IsChecked}}hide{{end}}" id="label_{{.ID}}" href="{{$.RepoLink}}/issues?labels={{.ID}}" style="color: {{.ForegroundColor}}; background-color: {{.Color}}">{{.Name | Sanitize}}</a>
276276
</div>
277277

278278
{{end}}
@@ -294,7 +294,7 @@
294294
{{.i18n.Tr "repo.issues.new.open_milestone"}}
295295
</div>
296296
{{range .OpenMilestones}}
297-
<div class="item" data-id="{{.ID}}" data-href="{{$.RepoLink}}/issues?milestone={{.ID}}"> {{.Name}}</div>
297+
<div class="item" data-id="{{.ID}}" data-href="{{$.RepoLink}}/issues?milestone={{.ID}}"> {{.Name | Sanitize}}</div>
298298
{{end}}
299299
{{end}}
300300
{{if .ClosedMilestones}}
@@ -304,7 +304,7 @@
304304
{{.i18n.Tr "repo.issues.new.closed_milestone"}}
305305
</div>
306306
{{range .ClosedMilestones}}
307-
<a class="item" data-id="{{.ID}}" data-href="{{$.RepoLink}}/issues?milestone={{.ID}}"> {{.Name}}</a>
307+
<a class="item" data-id="{{.ID}}" data-href="{{$.RepoLink}}/issues?milestone={{.ID}}"> {{.Name | Sanitize}}</a>
308308
{{end}}
309309
{{end}}
310310
</div>
@@ -313,7 +313,7 @@
313313
<span class="no-select item {{if .Issue.Milestone}}hide{{end}}">{{.i18n.Tr "repo.issues.new.no_milestone"}}</span>
314314
<div class="selected">
315315
{{if .Issue.Milestone}}
316-
<a class="item" href="{{.RepoLink}}/issues?milestone={{.Issue.Milestone.ID}}"> {{.Issue.Milestone.Name}}</a>
316+
<a class="item" href="{{.RepoLink}}/issues?milestone={{.Issue.Milestone.ID}}"> {{.Issue.Milestone.Name | Sanitize}}</a>
317317
{{end}}
318318
</div>
319319
</div>

0 commit comments

Comments
 (0)