[JSPWIKI-1140] Autogenerate changenote on page comments

• Type: Task
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 2.11.0-M8
• Fix Version/s: 2.11.0
• Component/s: Core & storage

Environment

Windows new version

Firefox version 84.0.1

• Assignee: Unassigned
• Reporter: Nguyen Dang Khai
• Created: 25/Dec/20 09:45
• Updated: 23/Nov/21 11:17
• Resolved: 16/Oct/21 16:16

Description

In the comment function, users can impersonate other users to leave comments.

Vulnerable code is line 86 in Comment.jsp :

// String author  = TextUtil.replaceEntities( request.getParameter("author") );

Replace any user in parameter author to impersonate.

• Request :

  POST /wikijsp_m8_war/Comment.jsp?page=Main HTTP/1.1
  Host: localhost:8080
  page=Main&action=save&encodingcheck=%E3%81%81&xnfull=1608888733842&submit_auth=&ok=&changenote=&author=dangkhai&link=&_editedtext=n%C3%A2nna%0D%0A