Skip to content
Snippets Groups Projects
  1. May 21, 2014
    • Jared Hancock's avatar
      Fix external image in an inline <a> element · 99e719d9
      Jared Hancock authored
      htmLawed stripped/discarded <div> tags nested inside inline tags such as
      <a>. The previous replacement engine would replace <img> tags with <div>
      tags and would cause the HTML to be corrupted by htmLawed.
      
      This patch uses <span> tags which have CSS rules to be displayed as
      inline-blocks. This should stay truer to the normal sizing and placement of
      the original <img> tag.
      99e719d9
  2. May 16, 2014
  3. May 15, 2014
  4. May 12, 2014
  5. May 09, 2014
  6. May 08, 2014
  7. May 07, 2014
  8. May 06, 2014
  9. May 05, 2014
    • Jared Hancock's avatar
      oops: Fixup bad merge · 21949b25
      Jared Hancock authored
      Previously, there was a bug in the ORM where magic properties would need to
      be declared in the model class.
      21949b25
  10. May 03, 2014
  11. May 02, 2014
    • Jared Hancock's avatar
      security: Remove potential XSS vulnerability · 9916214f
      Jared Hancock authored
      The ThreadEntryWidget has a potential cross site scripting (XSS)
      vulnerability if data was posted directly to the page hosting the widget
      
      Vulnerable URLs:
      view.php, open.php, scp/open.php, scp/tickets.php
      
      The content received in the HTTP POST is now correctly escaped when it is
      echoed back to the user agent.
      9916214f
    • Jared Hancock's avatar
      Fix images in new ticket notice to end user · 25b93083
      Jared Hancock authored
      Images placed in the "Issue Details" in a new ticket by staff are not
      correctly translated to the standard used in the storage model in the
      %ticket_thread table nor for the standard used by the email system.
      
      This patch changes the logic used to create the email template to fetch the
      sanitized and converted message body from the ThreadEntry instance created
      rather than reusing the raw message originally sent in the request.
      
      References:
      https://github.com/osTicket/osTicket-1.8/issues/816
      25b93083
  12. May 01, 2014
Loading