search

hotosm / osm-tasking-manager2

Designed and built for Humanitarian OpenStreetMap Team collaborative emergency/disaster mapping, the OSM Tasking Manager 2.0 divides an area into individual squares that can be rapidly mapped by thousands of volunteers.
http://tasks.hotosm.org
Other
425 stars 156 forks source link

fixes arbitrary js execution through osm username #917

Closed batpad closed 7 years ago

batpad commented 7 years ago

cc @smit1678 @bgirardot @pgiraud @ethan-nelson

coveralls commented 7 years ago

Coverage Status

Coverage remained the same at 94.901% when pulling 2b9246a3ff9913d4ae70702d1520757a23708e58 on osm-in:fixxs into 2c101609e2591d13f3bcca48688b25f7d1b57adc on hotosm:master.

smit1678 commented 7 years ago

Thanks @batpad. I deployed this on the HOT production deployment to patch it quick. 👍 from me. We'll want to circulate to the HOT list to share with others that are running their own osmtm.

pgiraud commented 7 years ago

Good catch! Aren't there other location in the templates where this should be done as well?

batpad commented 7 years ago

@pgiraud So I tested the users page which lists users and that seems to handle usernames like this fine. Not being too familiar with the code-base, it would be totally great for someone else to do a more thorough audit - I did check a few places where I know usernames showed up and they seemed protected from this, but I definitely could have missed something.