Skip to content
Snippets Groups Projects
  1. May 15, 2014
  2. May 12, 2014
  3. May 09, 2014
  4. May 08, 2014
  5. May 07, 2014
  6. May 06, 2014
  7. May 05, 2014
    • Jared Hancock's avatar
      oops: Fixup bad merge · 21949b25
      Jared Hancock authored
      Previously, there was a bug in the ORM where magic properties would need to
      be declared in the model class.
      21949b25
  8. May 03, 2014
  9. May 02, 2014
    • Jared Hancock's avatar
      security: Remove potential XSS vulnerability · 9916214f
      Jared Hancock authored
      The ThreadEntryWidget has a potential cross site scripting (XSS)
      vulnerability if data was posted directly to the page hosting the widget
      
      Vulnerable URLs:
      view.php, open.php, scp/open.php, scp/tickets.php
      
      The content received in the HTTP POST is now correctly escaped when it is
      echoed back to the user agent.
      9916214f
    • Jared Hancock's avatar
      Fix images in new ticket notice to end user · 25b93083
      Jared Hancock authored
      Images placed in the "Issue Details" in a new ticket by staff are not
      correctly translated to the standard used in the storage model in the
      %ticket_thread table nor for the standard used by the email system.
      
      This patch changes the logic used to create the email template to fetch the
      sanitized and converted message body from the ThreadEntry instance created
      rather than reusing the raw message originally sent in the request.
      
      References:
      https://github.com/osTicket/osTicket-1.8/issues/816
      25b93083
  10. May 01, 2014
  11. Apr 30, 2014
    • Jared Hancock's avatar
      tnef: Fix major issue iterating over attr streams · 34d8d0b4
      Jared Hancock authored
      The original logic would read the count of attributes in the stream and then
      read the first attribute in the constructor of TnefAttributeStreamReader.
      Then the iterator interface would call ::rewind() before iterating to the
      first item. rewind() set the @pos attribute to zero, which would cause the
      attribute count (4-byte int) to be interpreted incorrectly as part of the
      first attribute.
      
      The new logic sets the position at 4 after rewind()ing, and does not read
      the first attribute twice. It also properly detects the end of the attribute
      stream by the number of attributes advertised as the first four bytes of the
      stream (read into the @count attribute initially).
      34d8d0b4
  12. Apr 29, 2014
Loading