sab 1.0.0 glitterPreLoadHistory not sanitized
Posted: April 11th, 2016, 8:41 pm
OS: ubuntu 14.04.4
Versions:
$ apt-show-versions sabnzbdplus sabnzbdplus-theme-glitter
sabnzbdplus:all/trusty 1.0.0-0ubuntu1~jcfp1~trusty uptodate
sabnzbdplus-theme-glitter:all/trusty 1.0.0-0ubuntu1~jcfp1~trusty uptodate
Issue: When loading the main page of sabnzbd, the page is overrun by lines that appear to be log messages. Looking at the web inspector, I can see that the glitterPreLoadHistory variable contains lines that have html markup. The log lines are not being sanitized for quotes or html tags, thus screwing up the interface. The web inspector throws several exceptions, citing illegal characters.
At some point, a post-process script called some sabnzbd url, which resulted in html being returned. This html content is injected into the log lines and is being injected into the DOM.
The log has quite a bit of identifying information (indexer api keys, nzb names/locations, and ip addresses. If an interested developer gets in touch, I can send over the generated HTML I see on the page.
Thanks for an awesome product!
Versions:
$ apt-show-versions sabnzbdplus sabnzbdplus-theme-glitter
sabnzbdplus:all/trusty 1.0.0-0ubuntu1~jcfp1~trusty uptodate
sabnzbdplus-theme-glitter:all/trusty 1.0.0-0ubuntu1~jcfp1~trusty uptodate
Issue: When loading the main page of sabnzbd, the page is overrun by lines that appear to be log messages. Looking at the web inspector, I can see that the glitterPreLoadHistory variable contains lines that have html markup. The log lines are not being sanitized for quotes or html tags, thus screwing up the interface. The web inspector throws several exceptions, citing illegal characters.
At some point, a post-process script called some sabnzbd url, which resulted in html being returned. This html content is injected into the log lines and is being injected into the DOM.
The log has quite a bit of identifying information (indexer api keys, nzb names/locations, and ip addresses. If an interested developer gets in touch, I can send over the generated HTML I see on the page.
Thanks for an awesome product!