Hover ticket preview a potential security threat - Page 2

tony300 · 26-09-2007, 10:12 AM

Are you referring to the "HTML Conversion" setting in Tickets? It's set to Strip Tags. All our tickets come through email, the server is on an internal network.

SA is filtering the incoming mail, so only a few spam messages are getting through every day. It may take a while to see another one, but I will post the details when I do.

NC Software · 26-09-2007, 01:18 PM

Quote:

Originally Posted by tony300

It definitely does happen on 3.11.01, but I have only seen it a few times. I'll let you know when I get another one. Thanks.

I'm using 3.11.01 STABLE and I still have the issue. I saw it the other day with a spam e-mail that came in.

NC Software · 26-09-2007, 01:21 PM

Ironically here is one I have in my help desk right now. If you want me to forward this e-mail to you, let me know ASAP before I ban & delete it.

**Jamie Edwards** · 26-09-2007, 01:25 PM

Hi Neal,

Please forward the e-mail to me.

NC Software · 26-09-2007, 01:36 PM

I forwarded it, however, I'm not sure it will work as the ticket view strips the HTML. But at least you can see the problem DOES remain.

tony300 · 26-09-2007, 06:25 PM

Thanks Neal. Do you have the parser log enabled? If you click on a message in the parser log, it displays the email source including the headers. Maybe you could post that here, or email it to Jamie to help them track down the problem.

NC Software · 04-04-2008, 01:21 PM

This issue is still NOT fixed in the latest stable (3.20.02).

ecornet · 04-04-2008, 01:44 PM

Why not just disable the ticket preview option. That's how I have it setup

NC Software · 04-04-2008, 01:52 PM

Quote:

Originally Posted by ecornet

Why not just disable the ticket preview option. That's how I have it setup

Because we use it. Why not just fix the problem?

**Jamie Edwards** · 04-04-2008, 01:59 PM

I have reopened the bug: Kayako Bug Tracker - Viewing Issue #212 - Tags not stripped in mouse-over preview

ecornet · 04-04-2008, 04:55 PM

Quote:

Originally Posted by NC Software

Because we use it. Why not just fix the problem?

I mean if you are concerned about security, while it is still broken and waiting for a fix, why not just disable it?

Ryan Lederman · 17-04-2008, 11:25 PM

I have committed this bug fix to CVS as of today. It is confirmed that previously, HTML tags were being rendered in the mouse-over preview.

It is important to note that the stripping of the tags for the preview is adherent to the settings specified under Admin CP >> Mail Parser >> "Allow HTML Tags", so if you allow bold and italics tags here, you'll still see them in the mouse-over, just like you would for a normal ticket post.

Regards,

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Ticket locking reply preview improvement	jon	Duplicate Requests	0	03-07-2007 04:32 PM
Tickets Ticket list -> UI -> Better placement of preview hover	Southerncentralrain	Feature Requests	0	26-05-2007 02:20 PM
New Build: 3.10.02 STABLE	Ryan Lederman	News and Announcements	0	05-03-2007 09:53 PM

tony300 Offline New Member Posts: 4 Join Date: Sep 2007	26-09-2007, 10:12 AM Are you referring to the "HTML Conversion" setting in Tickets? It's set to Strip Tags. All our tickets come through email, the server is on an internal network. SA is filtering the incoming mail, so only a few spam messages are getting through every day. It may take a while to see another one, but I will post the details when I do.

NC Software Offline Member Posts: 523 Join Date: Dec 2005 Location: Sitting	26-09-2007, 01:36 PM I forwarded it, however, I'm not sure it will work as the ticket view strips the HTML. But at least you can see the problem DOES remain. Neal Culiner NC Software, Inc. Visual Basic .NET Forums 3.30.02 STABLE

tony300 Offline New Member Posts: 4 Join Date: Sep 2007	26-09-2007, 06:25 PM Thanks Neal. Do you have the parser log enabled? If you click on a message in the parser log, it displays the email source including the headers. Maybe you could post that here, or email it to Jamie to help them track down the problem.

NC Software Offline Member Posts: 523 Join Date: Dec 2005 Location: Sitting	04-04-2008, 01:21 PM This issue is still NOT fixed in the latest stable (3.20.02). Neal Culiner NC Software, Inc. Visual Basic .NET Forums 3.30.02 STABLE

ecornet Offline Member Posts: 159 Join Date: Feb 2008	04-04-2008, 01:44 PM Why not just disable the ticket preview option. That's how I have it setup VoiceWay IP Telephony for Business and Residential