Skip to content

Escape Email in forgot_password.tmpl (#12610)#12612

Merged
jolheiser merged 1 commit into
go-gitea:release/v1.12from
jolheiser:backport-12610
Aug 26, 2020
Merged

Escape Email in forgot_password.tmpl (#12610)#12612
jolheiser merged 1 commit into
go-gitea:release/v1.12from
jolheiser:backport-12610

Conversation

@jolheiser
Copy link
Copy Markdown
Member

Backport #12610

Credit: @zeripath

Signed-off-by: Andrew Thornton <art27@cantab.net>
@jolheiser jolheiser added this to the 1.12.4 milestone Aug 26, 2020
@GiteaBot GiteaBot added the lgtm/need 1 This PR needs approval from one additional maintainer to be merged. label Aug 26, 2020
@GiteaBot GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Aug 26, 2020
@jolheiser jolheiser merged commit 981216c into go-gitea:release/v1.12 Aug 26, 2020
@jolheiser jolheiser deleted the backport-12610 branch August 26, 2020 15:12
@lafriks
Copy link
Copy Markdown
Member

lafriks commented Aug 27, 2020

Note for blog post:
Thanks to Osama Hamad (https://github.com/osamahamad) for reporting this security issue

@silverwind
Copy link
Copy Markdown
Member

silverwind commented Aug 27, 2020

As a more general fix, I think .i18n.Tr should escape by default unless there's HTML content in the english translation string (would not trust other languagues). Thought we should probably just eliminate HTML in translation strings altogether which would allow us to escape everything.

@go-gitea go-gitea locked and limited conversation to collaborators Nov 24, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. type/bug

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants