Bugzilla – Bug 11844
php - XSS vulnerabilities
Last modified: 2006-06-11 11:02:20 UTC
New version of phpMyAdmin fixes: * XSS vulnerability (set_theme) * mysqli problems with zend.ze1_compatibility_mode enabled * setup script did not save the mysql/mysqli extension * XSS vulnerability (calling directly css files under themes) * other XSS vulnerabilities (lang, theme, db) This contains security fixes. Version 2.8.0.4 should be integrated to stable-rc and stable. p4 changes 79245 (devel) and 79246 (test).
Seems if it is "Product: Security" there aren't choices for: "fixed in lesser branch" and "integrate to $BRANCH grimoire" Changed "Product" to Codex.
setting flags to ?
Looks good, can be integrated.
Integrated/fixed.
email to sm-security sent http://lists.ibiblio.org/pipermail/sm-security/2006-May/000492.html
I'd like to leave this in security component for historical searching The flags weren't very useful to use because we usually just have the fixer integrate to stable. Security updates have bypassed other processes. It's easy to add those flags to security. I've just done that now. I've also added a sm-security note sent flag as well.
(In reply to comment #6) > I'd like to leave this in security component for historical searching I disagree. I started filing CVE bugs against security a while ago and they were mostly ignored because the default assignee is security@ which is not as useful as having them assigned to the relevant grimoire guru. Instead I started assigning them as normal via the codex product and just copying security, which also allows searching. Things got fixed a lot faster. I could have left them as security and copied the guru myself but then I have to look them all up. Of course we could also add the full codex tree and assignee logic to the security product but that sounds like a lot of duplication, and we'd have to include the grimoire subgroups as well as the sorcery subgroups, tome, etc. Now that each component is responsible for its own security I think we should just assign these through the relevant tcomponent so the right subgroups are invoked and include security some other way, either a cc or another flag or something.
To add a little to the flag inflation, we could add a "security bug" flag for easier searching and still keep the bugs themselves in the product they belong (codex,sorcery,cauldron,...).