IV83117: TITLE: TINY MCE NOTE EDITOR. ALLOWS YOU TO ENTER HTML TEXT THAT FIRES AN ALERT (HTML EDIT LINK)

3.5.0-TIV-TAP-FP002-WIN
3.5.0-TIV-TAP-FP002-README
3.5.0-TIV-TAP-FP002-LIN
3.5.0-TIV-TAP-FP002-AIX
3.4.2-TIV-TAP-FP004-WIN
3.4.2-TIV-TAP-FP004-README
3.4.2-TIV-TAP-FP004-LIN
3.4.2-TIV-TAP-FP004-AIX

APAR status

• Closed as fixed if next.

Error description

• A Cross Site Scripting (XSS) attack occurs when an attacker
  uses a web application to inject malicious code in the form of
  a client side script  arbitrary JavaScript  to an end user.
  
  ONE EXAMPLE OF MANY THROUGHOUT THE APPLICAITON:
  
  Attack value: <p>123</p><p><input onclick="alert(1234)"
  type="text"/></p>
  
  1. Login into application
  2. Click on Help link
  3. Click on HTML link of the editor to open HTML Source Editor
  4. Apply attack value and click on UPDATE button
  5. Click on Save button
  6. Click on recently added value
  

Local fix

• N/A
  

Problem summary

• Need ability to disable HTML Editor in Note Fields.
  

Problem conclusion

• A new property is added in TRIRIGAWEB.properties file called
  TINYMCE_HTML_EDITOR_ENABLED. This property will determine if
  "HTML Editor" button will be displayed in form notes field. By
  default the value of this property is set to true, which will
  display the button in notes field. Note fields are vulnerable
  to attack if the button is enabled. This is targeted to the
  1H2016 release, as well as the 3.5.0.2 fix pack.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Modules/Macros

• 999
  

Fix information

Applicable component levels