Ticket search results

CVE-2019-10085: XSS on user autocomplete

Dave Brondsema — Tue, 18 Jun 2019 14:57:24 -0000

Via security@apache.org report > ... > > 3\. Go to http://localhost:8080/auth/preferences/ and set > "" (without the quotes) as your Display Name > under Preferences / General Settings. Save. > > 4\. As test-user, create a new Project. Let's assume the URL for the > project is http://localhost:8080/p/abc > > 5\. For that Project, go to http://localhost:8080/p/abc/tickets/new/ > > 6\. In the Owner dropdown on the Create Ticket page, type the letter "s" > > ...

Disabling a user does not remove/disable his primary email

Alexander Luberg — Thu, 20 Aug 2015 22:07:00 -0000

1) Sign up a user with email abc@abc.com 2) Verify his account/email 3) From user prefs - disable this account 4) Sign up a new user with the same email abc@abc.com 5) Verify his account/email 6) Password recovery won't work for him(And most probably we will run into some other issues) email_address collection state: ~~~~~ > db.email_address.find({email: 'abc@abc.me'}) { "_id" : ObjectId("5436e94d01a61326884419c6"), "nonce" : null, "claimed_by_user_id" : ObjectId("5436e94d01a61326884419a0"), "confirmed" : true, "email" : "abc@abc.com" } { "_id" : ObjectId("543aaa0601a61361523e52ac"), "nonce" : null, "claimed_by_user_id" : ObjectId("543aaa0601a61361523e5286"), "confirmed" : true, "email" : "abc@abc.com" } ~~~~~ first one is linked to the disabled user, the second one to the current, active user.

Fix error about adding tags

Dave Brondsema — Thu, 20 Aug 2015 22:07:54 -0000

This appears in the logs when editing a ticket, but everything seems to work fine. ~~~~ 17:57:12,620 ERROR [allura.lib.markdown_extensions] Error adding
tags: new text is

abc
defxjgimwge:artifact:0000

Traceback (most recent call last): File "/home/dbrondsema/dbrondsema-7024/forge/Allura/allura/lib/markdown_extensions.py", line 300, in run new_node = markdown.etree.fromstring(new_text) File "", line 85, in XML SyntaxError: not well-formed (invalid token): line 1, column 15 ~~~~