Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[vuln] OpenRedirect leads to XSS attack in login.php #316

Open
wants to merge 7 commits into
base: testlink_1_9_20_fixed
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -755,7 +755,7 @@ BEFORE the commit ID. => then Nike => Just DO IT
[upgf]: http://forum.testlink.org/viewforum.php?f=11
[uupg]: http://forum.testlink.org/viewforum.php?f=58
[tucf]: http://www.testlink.org/
[mbug]: http://www.testlink.org/mantis/
[mbug]: http://mantis.testlink.org/
[twt]: http://twitter.com/#!/TLOpenSource
[free]: http://www.freetest.net.br
[csrf]: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet
Expand Down
15 changes: 10 additions & 5 deletions gui/templates/tl-classic/requirements/reqTcAssign.tpl
Original file line number Diff line number Diff line change
Expand Up @@ -58,8 +58,6 @@ function refreshAndClose(tcase_id,callback) {
{$msgReqLinkingEnabled = $labels.reqLinkingDisabledAfterExec}
{/if}



<body>
{$sep = $smarty.const.TITLE_SEP}
{$tcIdentity = "{$gui->tcTitle|escape} "}
Expand All @@ -83,9 +81,10 @@ function refreshAndClose(tcase_id,callback) {
{/if}

<p><span class="labelHolder">{$labels.req_spec}</span>
<select name="idSRS" id="idSRS" onchange="form.submit()">
<select name="idSRS" id="idSRS" class="idSRS" onchange="form.submit()">
<option></option>
{html_options options=$gui->arrReqSpec selected=$gui->selectedReqSpec}
</select>
</select></p>
</form>
{if $gui->showCloseButton}
<form name="closeMeTop">
Expand Down Expand Up @@ -239,5 +238,11 @@ function refreshAndClose(tcase_id,callback) {
</div>
</form>
{/if}

<script type="text/javascript">
jQuery( document ).ready(function() {
jQuery(".idSRS").chosen({ width: "70%", search_contains: true });
});
</script>
</body>
</html>
</html>
Original file line number Diff line number Diff line change
Expand Up @@ -18,12 +18,34 @@ ALTER TABLE /*prefix*/builds ADD COLUMN branch varchar(64) NULL;
ALTER TABLE /*prefix*/builds ADD COLUMN release_candidate varchar(100) NULL;

--
ALTER TABLE /*prefix*/users MODIFY password VARCHAR(255);
ALTER TABLE /*prefix*/users MODIFY password VARCHAR(255) NOT NULL default '';

--
ALTER TABLE /*prefix*/testplan_platforms ADD COLUMN active tinyint(1) NOT NULL default '1';
ALTER TABLE /*prefix*/platforms ADD COLUMN enable_on_design tinyint(1) NOT NULL default '0',
ALTER TABLE /*prefix*/platforms ADD COLUMN enable_on_execution tinyint(1) NOT NULL default '1',
ALTER TABLE /*prefix*/platforms ADD COLUMN enable_on_design tinyint(1) NOT NULL default '0';
ALTER TABLE /*prefix*/platforms ADD COLUMN enable_on_execution tinyint(1) NOT NULL default '1';

--
ALTER TABLE /*prefix*/nodes_hierarchy ADD INDEX /*prefix*/nodes_hierarchy_node_type_id (node_type_id);
ALTER TABLE /*prefix*/testcase_keywords ADD INDEX /*prefix*/idx02_testcase_keywords (tcversion_id);

ALTER TABLE /*prefix*/milestones MODIFY target_date date NOT NULL;
ALTER TABLE /*prefix*/milestones MODIFY start_date date DEFAULT NULL;

--
CREATE TABLE /*prefix*/execution_tcsteps_wip (
id int(10) unsigned NOT NULL auto_increment,
tcstep_id int(10) unsigned NOT NULL default '0',
testplan_id int(10) unsigned NOT NULL default '0',
platform_id int(10) unsigned NOT NULL default '0',
build_id int(10) unsigned NOT NULL default '0',
tester_id int(10) unsigned default NULL,
creation_ts TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
notes text,
status char(1) default NULL,
PRIMARY KEY (id),
UNIQUE KEY /*prefix*/execution_tcsteps_wip_idx1(`tcstep_id`,`testplan_id`,`platform_id`,`build_id`)
) DEFAULT CHARSET=utf8;


CREATE TABLE /*prefix*/testcase_platforms (
Expand All @@ -45,7 +67,7 @@ CREATE TABLE /*prefix*/baseline_l1l2_context (
end_exec_ts timestamp NOT NULL,
creation_ts timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
PRIMARY KEY (id),
UNIQUE KEY udx1 (testplan_id,platform_id,creation_ts),
UNIQUE KEY udx1 (testplan_id,platform_id,creation_ts)
) DEFAULT CHARSET=utf8;


Expand Down Expand Up @@ -73,9 +95,6 @@ AS SELECT tcversion_id, testplan_id,build_id,platform_id,max(id) AS id
FROM /*prefix*/executions
GROUP BY tcversion_id,testplan_id,build_id,platform_id;

ALTER TABLE /*prefix*/nodes_hierarchy ADD INDEX /*prefix*/nodes_hierarchy_node_type_id (node_type_id);
ALTER TABLE /*prefix*/testcase_keywords ADD INDEX /*prefix*/idx02_testcase_keywords (tcversion_id);


CREATE OR REPLACE VIEW /*prefix*/tcversions_without_platforms
AS SELECT
Expand Down
1 change: 1 addition & 0 deletions lib/functions/oauth_providers/github.php
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,7 @@ function oauth_get_token($authCfg, $code) {
// If token is received start session
if (isset($tokenInfo->access_token)) {
$oauthParams['access_token'] = $tokenInfo->access_token;
$curlContentType = array('Authorization: token ' . $tokenInfo->access_token, 'Content-Type: application/xml','Accept: application/json');

$queryString = http_build_query($tokenInfo);
$targetURL = array();
Expand Down
4 changes: 2 additions & 2 deletions lib/functions/tlUser.class.php
Original file line number Diff line number Diff line change
Expand Up @@ -587,7 +587,7 @@ public function comparePassword(&$dbH,$pwd)
// MD5 hash check
// This is valid ONLY for internal password management
$encriptedPWD = $this->getPassword();
if (strlen($encriptedPWD) == 32) {
if (strlen($encriptedPWD) === 32) {
/* Update the old MD5 hash to the new bcrypt */
if ($encriptedPWD == md5($pwd)) {
$this->password = $this->encryptPassword($pwd,$this->authentication);
Expand Down Expand Up @@ -1522,4 +1522,4 @@ function hasRightWrap(&$db,$roleQuestion,$context=null) {
$cx['checkPublicPrivateAttr']);
}

}
}
10 changes: 7 additions & 3 deletions lib/issuetrackerintegration/jirarestInterface.class.php
Original file line number Diff line number Diff line change
Expand Up @@ -401,9 +401,13 @@ public function addIssue($summary,$description,$opt=null)
}
}


if (property_exists($opt, 'reporter')) {
$issue['fields']['reporter'] = array('name' => (string)$opt->reporter);
if (property_exists($opt, 'reporter')) {
$accountid = $this->APIClient->getAccountId($opt->reporter_email);
if($accountid) {
$issue['fields']['reporter'] = array('accountId' => (string)$accountid);
} else {
$issue['fields']['reporter'] = array('name' => (string)$opt->reporter);
}
}

if (property_exists($opt, 'issueType')) {
Expand Down
38 changes: 36 additions & 2 deletions third_party/fayp-jira-rest/Jira.php
Original file line number Diff line number Diff line change
Expand Up @@ -523,5 +523,39 @@ public function getCreateIssueMetadata($projectKeys=null,$opt=null)
return $items;
}


}
/**
* getAccountId
*
* @return mixed
*/
public function getAccountId($email)
{
$cmd = $this->host . 'groupuserpicker?query=' . $email;
$this->request->openConnect($cmd, 'GET');
$this->request->execute();
if ($result = json_decode($this->request->getResponseBody())) {
if (!isset($result->users)) {
//error_log('cannot find user');
return false;
}
$infos = $result->users->users;
$cnt = $result->users->total;
if ($infos) {
foreach ($infos as $info) {
if ($info->accountId) {
return $info->accountId;
}
}
}
return false;
}
else
{
// ATTENTION \Exception in order to use PHP object.
$msg = "Error Processing Request - " . __METHOD__ . ' ' .
implode('/', $items->errorMessages);
throw new \Exception($msg, 999);
}
return false;
}
}