xss filter

[sventantau]

Hi guys,
please see my changes to filter strings for html output.
Regards,
Sven

[tevans]

Hi Sven -

Thanks for sending this in ... looks good to me. Let's give the other devs a chance to look it over, and then we should be able to get it merged back into the master soon.

Regards,
Tom

[sventantau]

Hi Tom.

I would like to discuss a csrf (cross site request forgery) protection for the web interface.
Where would be the best place to do that? Should I open another issue here in github? Or do you guys discuss that kind of stuff at igniterealtime.org?

[Flowdalic]

Please use http://community.igniterealtime.org/community/developers/openfire_dev for discussing openfire development.

@sventantau darly asked if your commit will fix http://issues.igniterealtime.org/browse/OF-705, if it does, the issue key should be mentioned in your commit message so that the issue is linked to the commit.

[sventantau]

Hi Florian.

I started a discussion in the mentioned forum.

Without knowing the details of the 705 exploit: my patch only fixes parts of the problem since csrf is still possible.

http://issues.igniterealtime.org/browse/OF-686
http://issues.igniterealtime.org/browse/OF-687
http://issues.igniterealtime.org/browse/OF-705

are roughly about the same thing.. so you might want to merge them somehow..

Since the mentioned exploit is non-free here my version for reference:
https://dev.beastiebytes.com/root/sandbox/wikis/openfire-3.8.2-exploit

The problem with csrf protections is that they are useless once there is a xss vector present and you usually don't need xss to perform csrf.

Regards,
Sven