[FS #382] [snippet] Websignup allows HTML tags in username

I can sign up "<strong>myname" as User name or Full name, for exmaple.
This causes producing a wonderfull page

I think, It is better remove all HTML tags from all input forms as well as user name.
But I’m afraid that I overlook any important points.
So please tell me your opinion.

Thank you all.

Thank for catching this. Can you please enter this in the bugtracking system and flag it as urgent? This needs to get fixed ASAP.

Victor

I added this issue as "FS #382".

Thank you

Hi,

I just have to ask if this very important issiue has been fixed? I have this problem in my version which is the 0.9.2

I think its a very serious treat to my site, so I don’t want to launch it before it has been solved. So does anyone know if there is some fix out there or so?

Can’t it just be fixed by simple php function stripping html in the username text field? Is it something that anybody has done yet? Shouldn’t be hard to implent, right?

Thank you very much,
Björn
Sweden

Hi beejay, could you please check the bugtracker for resolutions to bug reports - you’ll find the solution here.

Oh, Im sorry, didnt know there was such section!

Although i got this on your URL:

"Flyspray cannot provide the page you requested. Perhaps you requested a task that does not exist, or you do not have permission to view the page you wanted."

But ill search the page for the fix,
Thank you,

Edit: Hm, actually, i can’t find the solution to this. :S Could you check the url and paste again please?

Björn

Ah, I see. It’s in a restricted area. My bad.

Here’s the fix (posted by netnoise):

FIX websignup.inc.php (line 26):
=======================
$username = $modx->db->escape($modx->stripTags($_POST[’username’]));
$fullname = $modx->db->escape($modx->stripTags($_POST[’fullname’]));
$email = $modx->db->escape($modx->stripTags($_POST[’email’]));
$password = $modx->db->escape($modx->stripTags($_POST[’password’]));
$country = $modx->db->escape($modx->stripTags($_POST[’country’]));
$state = $modx->db->escape($modx->stripTags($_POST[’state’]));
$zip = $modx->db->escape($modx->stripTags($_POST[’zip’]));
$formcode = $_POST[’formcode’];

Thank you very much!