Skip to content
Snippets Groups Projects
  1. May 08, 2014
  2. May 07, 2014
  3. May 06, 2014
  4. May 05, 2014
    • Jared Hancock's avatar
      oops: Fixup bad merge · 21949b25
      Jared Hancock authored
      Previously, there was a bug in the ORM where magic properties would need to
      be declared in the model class.
      21949b25
  5. May 03, 2014
  6. May 02, 2014
    • Jared Hancock's avatar
      security: Remove potential XSS vulnerability · 9916214f
      Jared Hancock authored
      The ThreadEntryWidget has a potential cross site scripting (XSS)
      vulnerability if data was posted directly to the page hosting the widget
      
      Vulnerable URLs:
      view.php, open.php, scp/open.php, scp/tickets.php
      
      The content received in the HTTP POST is now correctly escaped when it is
      echoed back to the user agent.
      9916214f
    • Jared Hancock's avatar
      Fix images in new ticket notice to end user · 25b93083
      Jared Hancock authored
      Images placed in the "Issue Details" in a new ticket by staff are not
      correctly translated to the standard used in the storage model in the
      %ticket_thread table nor for the standard used by the email system.
      
      This patch changes the logic used to create the email template to fetch the
      sanitized and converted message body from the ThreadEntry instance created
      rather than reusing the raw message originally sent in the request.
      
      References:
      https://github.com/osTicket/osTicket-1.8/issues/816
      25b93083
  7. May 01, 2014
Loading