Insert "<script>alert(1)</script>" in a label and when it's shown in the "In other languages" section, the script snippet is executed.
Version: master
Severity: normal
Description
Description
Details
Details
- Reference
- bz53472
Event Timeline
Comment Actions
Created attachment 13188
Bugfix for the issue
Another less serious (can only be exploited by admins) XSS is address too.
Attached:
Comment Actions
Thanks Liangent! That looks like a reasonable fix. Let me do some testing on it, and we'll get it deployed asap.
Comment Actions
Created attachment 13189
htmlspecialchars( Utils::fetchLanguageName( $language ) ) too
It looks better for me to htmlspecialchars( Utils::fetchLanguageName( $language ) ) too, though Utils::fetchLanguageName() has a fixed set of outputs currently.
Attached:
Comment Actions
Reviewed and tested by Aude too. Deployed.
18:37 logmsgbot: csteipp synchronized php-1.22wmf13/extensions/Wikibase
18:35 logmsgbot: csteipp synchronized php-1.22wmf14/extensions/Wikibase
I'll add into gerrit too.
Comment Actions
Change 176610 had a related patch set (by Dereckson) published:
Extra language names configuration for Wikidata
Comment Actions
Change 176610 had a related patch set uploaded (by Dereckson):
Extra language names configuration for Wikidata