Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-49304

Unbalanced html tags can make pages completely unusable

    XMLWordPrintable

    Details

    • Testing Instructions:
      Hide

      Disable the atto html editor.
      Go to a course.
      Turn editing on.
      Edit one of the course's topics. (take note of the editsection.php URL)
      add the following bad HTML to the summary.

      </div></div></div>
      <script>
      <script type="text/javascript">
      <!--

      Save changes.

      Without the patch the course will no longer display correctly. The edit icon for the topic that was just edited is no longer visible. (You will have to use the previously noted URL to manually fix the HTML via the interface or edit it in the DB.)

      With the patch the course will continue to display correctly.

      Show
      Disable the atto html editor. Go to a course. Turn editing on. Edit one of the course's topics. (take note of the editsection.php URL) add the following bad HTML to the summary. </div></div></div> <script> <script type="text/javascript"> <!-- Save changes. Without the patch the course will no longer display correctly. The edit icon for the topic that was just edited is no longer visible. (You will have to use the previously noted URL to manually fix the HTML via the interface or edit it in the DB.) With the patch the course will continue to display correctly.
    • Affected Branches:
      MOODLE_27_STABLE, MOODLE_28_STABLE, MOODLE_38_STABLE
    • Epic Link:
    • Pull from Repository:
    • Pull 3.10 Branch:
      MDL-49304-310-3
    • Pull 3.10 Diff URL:
    • Pull Master Branch:
      MDL-49304-master-3
    • Pull Master Diff URL:
    • Story Points:
      2
    • Sprint:
      International 4.0 - Sprint 2, International 4.0 - Sprint 3, International 4.0 - Sprint 4, International 4.0 - Sprint 5, International 4.0 - Sprint 6, International 4.0 - Sprint 7, Internationals - 3.11 Sprint 4, Internationals - 3.11 Sprint 5

      Description

      If you enter code in an editor (or textarea) with unbalanced div tags, script tags, or html comments, it can completely break page rendering.

      At some point, it was decided that teachers are inherently trusted because there are some things they have to be able to do that would give them XSS capability. Because of that, we do absolutely no sanitization of teacher content in places like course sections, and we very frequently run into problems where they paste content from somewhere and it has unbalanced tags that then makes it impossible to fix via the UI.

        Attachments

          Issue Links

          has been marked as being related by

          Bug - A problem which impairs or prevents Moodle from functioning correctly. MDL-52724 Atto does not generate UL tags when pasting LI tags

          • Minor - Minor loss of function where workaround is possible
          • Development in progress

          Bug - A problem which impairs or prevents Moodle from functioning correctly. MDL-47002 Atto cleaning sometimes leaves un-closed html comments

          • Major - Major loss of function, incorrect output
          • Closed
          is duplicated by

          Bug - A problem which impairs or prevents Moodle from functioning correctly. MDL-70636 Grid Course Layout: Incorrect list elements in text field mess up entire course structure

          • Minor - Minor loss of function where workaround is possible
          • Closed

            Activity

              People

              Assignee:
              dobedobedoh Andrew Nicols
              Reporter:
              emerrill Eric Merrill
              Peer reviewer:
              Tim Hunt
              Integrator:
              Eloy Lafuente (stronk7)
              Participants:
              Component watchers:
              Adrian Greeve, Jake Dallimore, Mathew May, Mihail Geshoski, Peter Dias, Sujith Haridasan, Andrew Nicols, Jun Pataleta, Michael Hawkins, Shamim Rezaie, Simey Lameze
              Votes:
              9 Vote for this issue
              Watchers:
              24 Start watching this issue

                Dates

                Created:
                Updated:

                  Time Tracking

                  Estimated:
                  Original Estimate - 0 minutes
                  0m
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 2 days, 6 hours, 37 minutes
                  2d 6h 37m