Bug 855112

Summary:	Encode XML-unsafe characters from user input as XML entities
Product:	Red Hat Enterprise Linux 6	Reporter:	Jan Pokorný [poki] <jpokorny>
Component:	luci	Assignee:	Ryan McCabe <rmccabe>
Status:	CLOSED ERRATA	QA Contact:	Cluster QE <mspqa-list>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	6.3	CC:	cluster-maint, fdinitto, jpokorny, lherbolt, rmccabe, rsteiger
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	luci-0.26.0-59.el6	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:
Clones:	855117 855120 855121 858386 1138585 (view as bug list)		Environment:
Last Closed:	2014-10-14 04:12:06 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	855121
Bug Blocks:	855117, 855120

Description Jan Pokorný [poki] 2012-09-06 18:03:39 UTC

In connection to case discussed in the public cluster ML [1], we need
to make sure the user input that makes its way into XML (either as
cluster.conf or XML-formatted requests towards ricci) is XML-ready.
That is, the "unsafe" characters are encoded as XML entities.

Otherwise, such requests have no effect and unfortunately, neither
ricci provides a sensible diagnostics about this.  Example of such
input is the password for the initial authentization against ricci.

[1] https://www.redhat.com/archives/linux-cluster/2012-August/msg00135.html

Comment 7 Fabio Massimo Di Nitto 2014-03-27 16:43:21 UTC

*** Bug 855121 has been marked as a duplicate of this bug. ***

Comment 8 Fabio Massimo Di Nitto 2014-03-27 16:43:37 UTC

*** Bug 858386 has been marked as a duplicate of this bug. ***

Comment 9 Fabio Massimo Di Nitto 2014-03-27 16:44:42 UTC

*** Bug 855117 has been marked as a duplicate of this bug. ***

Comment 10 Fabio Massimo Di Nitto 2014-03-27 16:45:33 UTC

*** Bug 855120 has been marked as a duplicate of this bug. ***

Comment 19 errata-xmlrpc 2014-10-14 04:12:06 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2014-1390.html

Comment 20 Red Hat Bugzilla 2023-09-14 01:37:14 UTC

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days