Loading...

XML

Word

Printable

Details

Type: Bug
Resolution: Fixed
Priority: Major
Fix Version/s: 5.2-milestone-2
Affects Version/s: 5.1
Component/s: Security
Labels:
None

Difficulty:
Unknown
Documentation:
N/A
Documentation in Release Notes:
http://www.xwiki.org/xwiki/bin/view/ReleaseNotes/ReleaseNotesXWiki52M2#HChoosingwhichtypesofattachmentscanbedisplayedinline28Security29
Similar issues:

Description

We can upload any kind of file as an attachment. The issue is that we can even upload some html / js files that would be executed if someone goes to the download page.

Attachments

- Sort By Name
- Sort By Date
- Ascending
- Descending
- Thumbnails
- List
- Download All

XWiki-9366.patch
2 kB
29/Jul/13 16:06
XWiki-9366-2.patch
7 kB
29/Jul/13 19:34

Issue Links

relates to

XWIKI-18368 XSS through SVG download

Closed

links to

Pull Request

Activity

People

Assignee:: Thomas Delafosse

Reporter:: Thomas Delafosse

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Dates

Created:: 29/Jul/13 15:52

Updated:: 02/Dec/22 10:58

Resolved:: 04/Sep/13 14:50

Date of First Response:: 04/Sep/13 2:51 PM