inex / IXP-Manager

Full stack web application powering peering at over 200 Internet Exchange Points (IXPs) globally.

Home Page:https://www.ixpmanager.org/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Notes preview in admin edit panels is not correctly rendered

listerr opened this issue · comments

ISSUE TYPE

Bug Report

VERSION
define( 'APPLICATION_VERSION', '6.3.1' );
define( 'APPLICATION_VERDATE', '2023062000' );
ENVIRONMENT
PHP 8.0.14 (cli) (built: Dec 20 2021 21:22:57) ( NTS )
Copyright (c) The PHP Group
Zend Engine v4.0.14, Copyright (c) Zend Technologies
    with Zend OPcache v8.0.14, Copyright (c), by Zend Technologies
ii  libapache2-mod-php8.0          8.0.14-1+ubuntu20.04.1+deb.sury.org+1                               amd64        server-side, HTML-embedded scripting language (Apache 2 module)
ii  php-common                     2:91+ubuntu20.04.1+deb.sury.org+1                                   all          Common files for PHP packages
ii  php-composer-ca-bundle         1.2.6-1                                                             all          utility library to find a path to the system CA bundle
ii  php-composer-semver            1.5.1-1                                                             all          utilities, version constraint parsing and validation
ii  php-composer-spdx-licenses     1.5.3-1                                                             all          SPDX licenses list and validation library
ii  php-composer-xdebug-handler    1.4.0-1                                                             all          Restarts a process without Xdebug
ii  php-json-schema                5.2.9-1                                                             all          implementation of JSON schema
ii  php-psr-container              1.0.0-2                                                             all          Common Container Interface (PHP FIG PSR-11)
ii  php-psr-log                    1.1.2-1                                                             all          common interface for logging libraries
ii  php-symfony-console            4.3.8+dfsg-1ubuntu1                                                 all          run tasks from the command line
ii  php-symfony-filesystem         4.3.8+dfsg-1ubuntu1                                                 all          basic filesystem utilities
ii  php-symfony-finder             4.3.8+dfsg-1ubuntu1                                                 all          find files and directories
ii  php-symfony-process            4.3.8+dfsg-1ubuntu1                                                 all          execute commands in sub-processes
ii  php-symfony-service-contracts  1.1.8-1                                                             all          Generic abstractions related to writing services
ii  php8.0                         8.0.14-1+ubuntu20.04.1+deb.sury.org+1                               all          server-side, HTML-embedded scripting language (metapackage)
ii  php8.0-bcmath                  8.0.14-1+ubuntu20.04.1+deb.sury.org+1                               amd64        Bcmath module for PHP
ii  php8.0-cgi                     8.0.14-1+ubuntu20.04.1+deb.sury.org+1                               amd64        server-side, HTML-embedded scripting language (CGI binary)
ii  php8.0-cli                     8.0.14-1+ubuntu20.04.1+deb.sury.org+1                               amd64        command-line interpreter for the PHP scripting language
ii  php8.0-common                  8.0.14-1+ubuntu20.04.1+deb.sury.org+1                               amd64        documentation, examples and common module for PHP
ii  php8.0-curl                    8.0.14-1+ubuntu20.04.1+deb.sury.org+1                               amd64        CURL module for PHP
ii  php8.0-ds                      1.4.0-1+ubuntu20.04.1+deb.sury.org+1                                amd64        PHP extension providing efficient data structures for PHP 7
ii  php8.0-fpm                     8.0.14-1+ubuntu20.04.1+deb.sury.org+1                               amd64        server-side, HTML-embedded scripting language (FPM-CGI binary)
ii  php8.0-gd                      8.0.14-1+ubuntu20.04.1+deb.sury.org+1                               amd64        GD module for PHP
ii  php8.0-igbinary                3.2.6+2.0.8-2+ubuntu20.04.1+deb.sury.org+3                          amd64        igbinary PHP serializer
ii  php8.0-intl                    8.0.14-1+ubuntu20.04.1+deb.sury.org+1                               amd64        Internationalisation module for PHP
ii  php8.0-mbstring                8.0.14-1+ubuntu20.04.1+deb.sury.org+1                               amd64        MBSTRING module for PHP
ii  php8.0-memcache                8.0+4.0.5.2+3.0.9~20170802.e702b5f9+-3+ubuntu20.04.1+deb.sury.org+3 amd64        memcache extension module for PHP
ii  php8.0-memcached               3.1.5+2.2.0-10+ubuntu20.04.1+deb.sury.org+3                         amd64        memcached extension module for PHP, uses libmemcached
ii  php8.0-msgpack                 2.2.0~rc1+2.1.2+0.5.7-2+ubuntu20.04.1+deb.sury.org+3                amd64        PHP extension for interfacing with MessagePack
ii  php8.0-mysql                   8.0.14-1+ubuntu20.04.1+deb.sury.org+1                               amd64        MySQL module for PHP
ii  php8.0-opcache                 8.0.14-1+ubuntu20.04.1+deb.sury.org+1                               amd64        Zend OpCache module for PHP
ii  php8.0-readline                8.0.14-1+ubuntu20.04.1+deb.sury.org+1                               amd64        readline module for PHP
ii  php8.0-rrd                     2.0.3+1.1.3-2+ubuntu20.04.1+deb.sury.org+3                          amd64        PHP bindings to rrd tool system
ii  php8.0-snmp                    8.0.14-1+ubuntu20.04.1+deb.sury.org+1                               amd64        SNMP module for PHP
ii  php8.0-xml                     8.0.14-1+ubuntu20.04.1+deb.sury.org+1                               amd64        DOM, SimpleXML, XML, and XSL module for PHP
ii  php8.0-yaml                    2.2.2+2.1.0+2.0.4+1.3.2-1+ubuntu20.04.1+deb.sury.org+3              amd64        YAML-1.1 parser and emitter for PHP
ii  php8.0-zip                     8.0.14-1+ubuntu20.04.1+deb.sury.org+1                               amd64        Zip module for PHP
CONFIGURATION
APP_DEBUG=false
APP_URL="https://portal.lonap.net"
APP_TIMEZONE="Europe/London"
APP_LOG="single"
APP_LOG_LEVEL=debug
IXP_MULTIIXP_ENABLED=false
IXP_RESELLER_ENABLED=true
IXP_RESELLER_RESOLD_BILLING=false
IXP_AS112_UI_ACTIVE=false
IXP_FE_LAYER2_ADDRESSES_CUST_CAN_EDIT=true
IXP_FE_LAYER2_ADDRESSES_EMAIL_ON_CHANGE_DEST="${IDENTITY_SUPPORT_EMAIL}"
IXP_FE_LAYER2_ADDRESSES_EMAIL_ON_CUSTOMER_CHANGE=true
IXP_FE_FRONTEND_DISABLED_LOGO=false
IXP_FE_CUSTOMER_BILLING_UPDATES_NOTIFY="xxxx@lonap.net"
IXP_FE_FRONTEND_DISABLED_RS_PREFIXES=true
IXP_FE_FRONTEND_DISABLED_NETINFO=true
IXP_FE_FRONTEND_DISABLED_CUSTKIT=true
IXP_FE_FRONTEND_DISABLED_CONSOLE=true
IXP_FE_FRONTEND_DISABLED_LOGO=false
IXP_FE_FRONTEND_DISABLED_LOOKING_GLASS=false
IXP_FE_FRONTEND_DISABLED_FILTERED_PREFIXES=false
IXP_FE_BETA_CORE_BUNDLES=true
IXP_FE_VLANINTERFACES_HOSTNAME_REQUIRED=false
GRAPHER_BACKENDS="mrtg|sflow"
GRAPHER_CACHE_ENABLED=true
GRAPHER_BACKEND_MRTG_DBTYPE="log"
GRAPHER_BACKEND_MRTG_WORKDIR="/srv/mrtg"
GRAPHER_BACKEND_MRTG_LOGDIR="http://xxxx/mrtg"
GRAPHER_BACKEND_SFLOW_ENABLED=true
GRAPHER_BACKEND_SFLOW_ROOT="https://xxxxt/grapher-sflow"
GRAPHER_BACKEND_SMOKEPING_ENABLED=false
IXP_API_JSONEXPORTSCHEMA_PUBLIC=true
VIEW_SKIN="lonap"
VIEW_SMARTY_SKIN="lonap"
CACHE_DRIVER=memcached
DOCTRINE_PROXY_AUTOGENERATE=false
DOCTRINE_CACHE=array
DOCTRINE_CACHE_NAMESPACE=IXPMANAGERNAMESPACE
IXP_API_RIR_EMAIL_TO=xxxx
IXP_API_RIR_EMAIL_FROM=xxxx
IXP_IRRDB_BGPQ3_PATH=/usr/bin/bgpq3
IXP_IRRDB_MIN_V4_SUBNET_SIZE=24
IXP_IRRDB_MIN_V6_SUBNET_SIZE=48
IXP_RPKI_RTR1_HOST=x.x.x.x
IXP_RPKI_RTR1_PORT=3323
IXP_RPKI_RTR2_HOST=x.x.x.x
IXP_RPKI_RTR2_PORT=8282
AUTH_PEERINGDB_ENABLED=true
PEERINGDB_OAUTH_CLIENT_ID="XXXXX"
PEERINGDB_OAUTH_CLIENT_SECRET="XXXXX"
PEERINGDB_OAUTH_REDIRECT="https://XXXX"
AUTH_PEERINGDB_PRIVS=2
AUTH_ZF1_PWHASH="bcrypt"
SESSION_DRIVER=file
IXP_NO_TRANSIT_ASNS_EXCLUDE=6461

SUMMARY

Notes preview in various places in the admin pages is not correctly rendered from Markdown.

The HTML is displayed but not rendered.

STEPS TO REPRODUCE

Enter a note in any notes page e.g. customer notes, switch notes etc.

image

Preview tab looks like:

image

EXPECTED RESULTS

Should be rendered html (same as for customer view / list view popup to display the same note)

IMPORTANCE

Low

Thanks @listerr - looks like an overzealous previous fix for an XSS issue.

Should be good for any HTML tags generated via markdown for the takes configured here.

Rob - you know what you're doing, use your own best judgement on the bug reporting template. I can always ask for more info.