Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Page Editor: Files manager - has Stored XSS via Uploading html file that has no extension. #23

Closed
Awilum opened this issue Nov 22, 2018 · 4 comments
Closed

Page Editor: Files manager - has Stored XSS via Uploading html file that has no extension. #23

Awilum opened this issue Nov 22, 2018 · 4 comments
Assignees
@Awilum
Labels
priority: high status: done type: improvement

Comments

@Awilum
Copy link
Member

Awilum commented Nov 22, 2018

Same issue that it was in Monstra monstra-cms/monstra#459
need to be fixed for Flextype Admin
@Awilum Awilum self-assigned this Nov 22, 2018
@Awilum
Copy link
Member Author

Awilum commented Nov 22, 2018

Fix implemented for Flextype Admin Plugin

Awilum added a commit that referenced this issue Nov 22, 2018
@Awilum
Page Editor: Files manager - has Stored XSS via Uploading html file t…
2631943 
…hat has no extension. #23
@Awilum Awilum closed this as completed Nov 22, 2018
@Awilum
Copy link
Member Author

Awilum commented Nov 22, 2018

this solution was used
https://stackoverflow.com/questions/38509334/full-secure-image-upload-script

@Awilum Awilum reopened this Nov 22, 2018
@Awilum
Copy link
Member Author

Awilum commented Nov 22, 2018

removing that solution

@Awilum
Copy link
Member Author

Awilum commented Nov 22, 2018

now using this Filesystem::uploadFile()

@Awilum Awilum closed this as completed Nov 22, 2018
Awilum added a commit that referenced this issue Nov 22, 2018
@Awilum
Page Editor: Files manager - has Stored XSS via Uploading html file t…
1c4dd95 
…hat has no extension. #23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@Awilum Awilum

Labels
priority: high status: done type: improvement
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@Awilum