0

I am checking website for XSS and Cross Site scripting issues and i found that in account form fields or user registration page form fields for First name and Last name A user can enter html/js code. For testing when i place the following JS code :

<script>alert("Here")</script>

It is saved and is run on page load. This is very strange, because i checked the template files and values are escaped as below:

<?php echo $this->escapeHtml($this->getObject()->getFirstname()) ?>

I have also confirmed if i am in correct template file by changing the label of field. I have read the following questions and tried to used them but did not worked for me.

How to escape output data?

Is there a generic way I can apply input filtering to Magento form processing?

Regarding to the observer method, it works, but when i try to login to magento admin, i cant, but when iremove the observer, i can login again.

Update: Check the two attached screenshots.

Form fields where i entered js code The alert message from the entered js code in the field

Kindly help me with this issue.

Thank you

0

Following the Anton Evers answer ( Is there a generic way I can apply input filtering to Magento form processing? ), i have created an observer. But the problem was that the sanitizeParams method can only process post data which is in single dimension array. For login forms at admin and front end, the form fields for user name and password are in array format like below:

<input type="text" id="username" name="login[username]" value="" class="required-entry input-text">

<input type="password" id="login" name="login[password]" class="required-entry input-text" value="">

TO fix this issue, i have modified the code in observer as below:

 public function sanitizeParams($observer)
{
    if(!Mage::app()->getStore()->isAdmin())
    {
        $post = Mage::app()->getRequest()->getParams();
        foreach($post as $pkey => $pvalue)
        {
            if(is_array($post[$pkey]))
            {
                foreach($post[$pkey] as $key => $value)
                {
                    $post[$pkey][$key] = filter_var($value, FILTER_SANITIZE_SPECIAL_CHARS);
                }
            }
            else
            {
                $post[$pkey] = filter_var($pvalue, FILTER_SANITIZE_SPECIAL_CHARS);
            }
        }

        $_POST = $post;
    }
}

And it fixed my problem, and is working fine now.

Thanks.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.