Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

Additional cross-site scripting bugs in login

Description

Additional cross-site scripting attacks possible in the login form.

Environment

None

Activity

Daniel Henninger July 17, 2008 at 10:00 PM

Daniel Henninger May 22, 2008 at 8:21 AM

Patience =) I aim to fix these and some other assorted issues for 3.5.2!

LG May 22, 2008 at 2:45 AM

Hi,

I really wonder why it take so long to resolve this issue. Just ignoring the parsed parameters (everything behind the ?) would be fine to fix this issue.
Of course one would no longer be able to access URL's directly and to set the username but that's how other applications solve this issue.

LG

Fixed

Details

Assignee

Reporter

Components

Fix versions

Affects versions

Priority

Created April 8, 2006 at 1:38 AM
Updated November 12, 2008 at 3:41 PM
Resolved August 25, 2008 at 11:48 PM