View Issue Details
ID | Project | Category | View Status | Date Submitted | Last Update |
---|---|---|---|---|---|
0000287 | XMB1 | Bugs | public | 2009-03-01 09:50 | 2010-01-23 18:18 |
Reporter | miqrogroove | Assigned To | miqrogroove | ||
Priority | high | Severity | crash | Reproducibility | always |
Status | closed | Resolution | fixed | ||
Product Version | 1.9.8 SP2 | ||||
Target Version | 1.9.11.03 | Fixed in Version | 1.9.11.03 | ||
Summary | 0000287: Opera treats application/octet-stream as text/html | ||||
Description | This is a little bit scary in terms of XSS vulnerability. I'm not even sure at this point if it can be fixed by XMB. | ||||
Steps To Reproduce | Open Opera and hit a *.php file attachment such as... http://forums.xmbforum.com/files.php?pid=1357206&aid=19497 | ||||
Additional Information | http://code.google.com/p/browsersec/wiki/Part2#Survey_of_content_sniffing_behaviors http://forums.xmbforum.com/viewthread.php?tid=762089&goto=search&pid=1280493 | ||||
Tags | No tags attached. | ||||
MySQL Version | |||||
PHP Version | |||||
Web Server | |||||
Browser | Opera | ||||
Flags | Critical Patch | ||||
Original Reporter | |||||
SVN Revision | 1764 | ||||
2009-03-01 12:10
|
issue287.patch (593 bytes)
Index: files.php =================================================================== --- files.php (revision 1755) +++ files.php (working copy) @@ -185,11 +185,11 @@ $db->query("UPDATE ".X_PREFIX."attachments SET downloads=downloads+1 WHERE aid=$aid"); // Set response headers -$type = strtolower($file['filetype']); -$type = ($type == 'text/html') ? 'text/plain' : $type; if ($file['img_size'] == '') { + $type = 'application/binary'; $dispositionType = 'attachment'; } else { + $type = strtolower($file['filetype']); $dispositionType = 'inline'; } |
|
This needs to be tested separately on version 1.9.10 because of the different attachment systems. |
2009-03-01 13:29
|
issue287-1_9_10.patch (494 bytes)
Index: viewthread.php =================================================================== --- viewthread.php (revision 1756) +++ viewthread.php (working copy) @@ -691,9 +691,8 @@ error($lang['filecorrupt']); } - $type = strtolower($file['filetype']); $size = (int) $file['filesize']; - $type = ($type == 'text/html') ? 'text/plain' : $type; + $type = 'application/binary'; header("Content-type: $type"); header("Content-length: $size"); |
|
Patches already attached. We have fixes that need to be released for the upgrader as well, so there's no need to hide this issue. This affects the Opera web browser only. |
Date Modified | Username | Field | Change |
---|---|---|---|
2009-03-01 09:50 | miqrogroove | New Issue | |
2009-03-01 09:50 | miqrogroove | Browser | => Opera |
2009-03-01 12:10 | miqrogroove | File Added: issue287.patch | |
2009-03-01 12:13 | miqrogroove | Status | new => confirmed |
2009-03-01 12:13 | miqrogroove | Projection | none => tweak |
2009-03-01 12:13 | miqrogroove | Product Version | 1.9.11 => 1.9.8 SP2 |
2009-03-01 12:13 | miqrogroove | Additional Information Updated | |
2009-03-01 12:20 | miqrogroove | Target Version | => 1.9.11.03 |
2009-03-01 12:38 | miqrogroove | Note Added: 0000163 | |
2009-03-01 13:29 | miqrogroove | File Added: issue287-1_9_10.patch | |
2009-03-01 18:03 | miqrogroove | Additional Information Updated | |
2009-03-01 19:08 | miqrogroove | Note Added: 0000165 | |
2009-03-01 19:08 | miqrogroove | Assigned To | => miqrogroove |
2009-03-01 19:08 | miqrogroove | Status | confirmed => assigned |
2009-03-01 19:08 | miqrogroove | ETA | none => < 1 day |
2009-03-01 19:08 | miqrogroove | View Status | private => public |
2009-03-01 19:08 | miqrogroove | Steps to Reproduce Updated | |
2009-03-01 19:37 | miqrogroove | Flags | => Critical Patch |
2009-03-01 19:37 | miqrogroove | SVN Revision | => 1764 |
2009-03-01 19:37 | miqrogroove | Status | assigned => resolved |
2009-03-01 19:37 | miqrogroove | Fixed in Version | => 1.9.11.03 |
2009-03-01 19:37 | miqrogroove | Resolution | open => fixed |
2010-01-23 18:18 | miqrogroove | Status | resolved => closed |