Textpattern CMS support forum
You are not logged in. Register | Login | Help
- Topics: Active | Unanswered
Cross-scripting issue with error pages?
I just received a PCI report that suggests there is a cross-scripting vulnerability for the TextPattern default_error page handling. This may well be a false-positive, but it seems like it is at least worth a fix.
Any suggestions on how I can redirect the URL to a ‘scrubbed’ version entity-encoding the sensitive characters (angle brackets, parens, etc.) ?
Offline
Re: Cross-scripting issue with error pages?
Please forward the report to us.
I take that the issue would be somewhere in your template code, how they are used or in plugins. You should fix the origin of the hole, rather than trying to monkey patch it by pre-filtering requests.
Last edited by Gocom (2013-12-18 07:18:07)
Offline