XSS Inclusion error

  • Posts: 29
  • Thank you received: 0
12 years 1 week ago #76520

Did you get the last one

Please Log in or Create an account to join the conversation.

  • Posts: 26158
  • Thank you received: 4028
  • MODERATOR
12 years 1 week ago #76521

Hi,

There is no XSS problem in the last link you sent me.
The HTML tags are right encoded in the page so they are not considered as HTML and block all XSS injection possibilities.

Regards,

Jerome - Obsidev.com
HikaMarket & HikaSerial developer / HikaShop core dev team.

Also helping the HikaShop support team when having some time or couldn't sleep.
By the way, do not send me private message, use the "contact us" form instead.

Please Log in or Create an account to join the conversation.

  • Posts: 29
  • Thank you received: 0
12 years 1 week ago #76524

It is modifying the head in the base= is changing to that the injection. Or may I wrong? Sorry if I don't know about this.

Please Log in or Create an account to join the conversation.

  • Posts: 26158
  • Thank you received: 4028
  • MODERATOR
12 years 1 week ago #76527

Hi,

XSS inclusion is to type some javascript code or HTML code in the URL and that code would be print directly in the page.
HikaShop replace critical tags by non HTML symbols like "<" to "&lt;". That's all.

There is no base changing or what ever. If you but "<strong>mytext</strong>" in the URL and you see your text in bold in your page, that's a breach. Otherwise, it's secured.
With tabber, you can do it. With Joomla and HikaShop you can't.

If you want to know more about XSS, you can read the wikipedia page which is quite complete
en.wikipedia.org/wiki/Cross-site_scripting

Regards,

Jerome - Obsidev.com
HikaMarket & HikaSerial developer / HikaShop core dev team.

Also helping the HikaShop support team when having some time or couldn't sleep.
By the way, do not send me private message, use the "contact us" form instead.
Last edit: 12 years 1 week ago by Jerome.

Please Log in or Create an account to join the conversation.

  • Posts: 29
  • Thank you received: 0
12 years 1 week ago #76528

Thank you so much. I just contact, The tabber dev to see if I can get any response from him. Once again thank you.

Please Log in or Create an account to join the conversation.

Time to create page: 0.067 seconds
Powered by Kunena Forum