Redmine

+1

I found the XSS in attached patch.
If I fill the project description like below, then open http://localhost:3000/admin/projects and hover the title of the project, the alert is showing.

<script>alert(1)</script>

the content function needs to escape the $(this).prop('title')

Thank you! It looks good to me.

Since the title attribute is too general and XSS may occur, I think it would be nice to disable HTML support.
IMO If you need HTML support, it may be better to add explicit attributes. (e.g. like html-safe? IDK)

Go MAEDA wrote:

Tooltip for issues or some other objects will disappear after applying the new patch. Please see the screenshot below for an example. It is a pity if I cannot see the useful information any longer.

You're right, but the plan is to add to all other objects that should have tooltips one by one. I'll update the patch to include the tooltip for object links as well.

Go Maeda, is it better if we remove the title the from gantt issue subject?

Mariuss-MacBook-Pro:redmine mariusbalteanu$ git diff
diff --git a/lib/redmine/helpers/gantt.rb b/lib/redmine/helpers/gantt.rb
index ef9475cea..ed2a8f8f7 100644
--- a/lib/redmine/helpers/gantt.rb
+++ b/lib/redmine/helpers/gantt.rb
@@ -747,7 +747,6 @@ module Redmine
         when Issue
           tag_options[:id] = "issue-#{object.id}" 
           tag_options[:class] = "issue-subject hascontextmenu" 
-          tag_options[:title] = object.subject
           children = object.children & project_issues(object.project)
           has_children = children.present? && (children.collect(&:fixed_version).uniq & [object.fixed_version]).present?
         when Version

Marius BALTEANU wrote:

Go Maeda, is it better if we remove the title the from gantt issue subject?

I agree.

But I would like to suggest another option. How about setting "Assignee (Status)" instead of removing the subject? The assignee and status are important information but those are not prominent in gantt.

Marius, which do you prefer?

diff --git a/lib/redmine/helpers/gantt.rb b/lib/redmine/helpers/gantt.rb
index ef9475cea..cc5b97cd7 100644
--- a/lib/redmine/helpers/gantt.rb
+++ b/lib/redmine/helpers/gantt.rb
@@ -747,7 +747,7 @@ module Redmine
         when Issue
           tag_options[:id] = "issue-#{object.id}" 
           tag_options[:class] = "issue-subject hascontextmenu" 
-          tag_options[:title] = object.subject
+          tag_options[:title] = "#{object.assigned_to&.name} (#{object.status.name})".lstrip
           children = object.children & project_issues(object.project)
           has_children = children.present? && (children.collect(&:fixed_version).uniq & [object.fixed_version]).present?
         when Version

Antonio McDeal wrote:

I think tool-tips like these should also be used as gantt tool-tips which display brief information when rolling cursor over issue lines of the timeline, because currently those kind of tool-tips in gantt aren't designed to spawn on the left, right, below or over the issue lines, depending on which side a free space available, so the tool-tip wouldn't end up half cut outside of the window.
I tested the way new tool-tips are displayed and saw that they actually support that kind of smart behavior.

It is a big change to discuss on this issue. Could you open a new issue?

Go MAEDA wrote:

Could you open a new issue?

Of course, I will do now. Could you please add this ticket as related if a relationship would make sense? I don't have a patch at the moment, but if nobody minds I might try to compose something a tad bit later next week. So far I figured out that jQuery tool-tips should support bare HTML fed into the title fields of tags (I'm aware of possible XSS but there is a good workaround I should test). Then there is multiple things from old tool-tips to consider for cleanup, including in style sheets, which shalt not be overlooked.

When adding some (self made) plugins that use Highcharts graphs, etc., there is no "tooltip" in the "title" attribute.
So,

if ($('[title]').tooltip !== undefined) {