We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
MODX Community Forums Archive

eForm & Cross Site Scripting (XSS)

    • 7130
    • 2 Posts
    derNager Reply #31, 16 years, 11 months ago
    Hi,

    i have a question about the updated Eform.
    I just copied the new version over to old one via ftp.
    But now my forms show an error "wrong value".
    I think that is because of the checkboxes i use and the new datatype?

    Do i have to change something in the snippetcode in backend of my modx?

    I hope u understand my question smiley

    Benni
      • 13428 ☆ A M B ☆
      • 1,031 Posts
      Jako Reply #32, 16 years, 10 months ago
      Just two questions: Normally the posted values of a form aren’t tested for XSS. But they are re-displayed in the form if one form field does not validate. Could this cause XSS? They are displayed too if there is a thankyou chunk. Could this cause XSS?

      I think this XSS patch is really nessesary for eForm if one of answers is true.
        • 9130
        • 171 Posts
        etal Reply #33, 16 years, 10 months ago
        Quote from: Jako at Oct 30, 2009, 06:28 AM

        Just two questions: Normally the posted values of a form aren’t tested for XSS. But they are re-displayed in the form if one form field does not validate. Could this cause XSS? They are displayed too if there is a thankyou chunk. Could this cause XSS?

        I think this XSS patch is really nessesary for eForm if one of answers is true.
        If the form is only displayed for the same user that entered the values how can that be considered xss? The user can only attack himself grin
          • 13428 ☆ A M B ☆
          • 1,031 Posts
          Jako Reply #34, 16 years, 10 months ago
          Good point. Thanks grin
            • 13428 ☆ A M B ☆
            • 1,031 Posts
            Jako Reply #35, 16 years, 10 months ago
            The select/option problem of derNager seems to be a bug in the patch.

            Regards
            Jako
              • 13428 ☆ A M B ☆
              • 1,031 Posts
              Jako Reply #36, 16 years, 10 months ago
              Bugfix for the select/option problem: The else part after lines 184 is not enclosed in brackets.

              Line 184:
                      { $dataType = stripslashes( $formats[$name][2] );


              Line 206: 
                      $fields[$name] = $value; }