search

vexim / vexim2

Virtual Exim 2
Other
70 stars 47 forks source link

Prevent XSS attacks #207

Closed alexpandele closed 8 years ago

alexpandele commented 8 years ago

The $_GET variables are echoed unmodified which represents a XSS risk. All the pages that require config/header.php are vulnerable.

Udera commented 8 years ago

Oops, that must be fixed. Should we also consider setting up a content security policy->http://www.html5rocks.com/en/tutorials/security/content-security-policy/? @rimas-kudelis

rimas-kudelis commented 8 years ago

The patch looks good, although I haven't tested. CSP is a separate issue that can be tackled in another bug/PR.

Udera commented 8 years ago

I just checked that error messages are still shown but not all combinations. Looks good for me as well. CSP will be a new PR.