About removing all tags : https://gfycat.com/fr/slimyvalidjavalina

• Same behaviour than RC or import : tag allowed, XSS for superamdin : https://github.com/LimeSurvey/LimeSurvey/pull/1665
• Same behaviour tha token admlin GUI : disallow tag and XSS : https://github.com/LimeSurvey/LimeSurvey/pull/1666

I think i prefer disallow tag and XSS for all user.

Fix committed to 3.x-LTS branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=30847

Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=30849

Added a PR https://github.com/LimeSurvey/LimeSurvey/pull/1721/files
Seems something was wrong
Not sure I made it right. I just removed some 500 errors

Arg … i cherry-pick … i check again master

Fixed in Release 3.25.8+210118

Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=30907

Why would a superadmin not be allowed to use tags in token atributes? Can we please fix that so it is allowed, at least for the custom attributes.

We have a discussion about this … maybe on zoho ?

Because it was , before the update : disallowed totally.
An alternative solution can be use LSYii_Validators for attributes : then simple admin and token user can use tag.
See : https://github.com/LimeSurvey/LimeSurvey/pull/1665/files#diff-a2eee4799865587f00bee528655e3af7d11394aed268da7d38cd294eb47e2ae8R377

The alternate commit …

PS : see https://bugs.limesurvey.org/view.php?id=16884 …
We need a scenario here …

The scenario would only be for superadmins, nobody else.
Can you please implement that?

Why superadmin ?
XSS_filter for admin
striptags for register
No ?

Any admin can use email send to add bad value. We must avoid it for registering only.
Right ?

PS : since this commit i use bbcode when i need tag in attribute s⋅…

master : https://github.com/LimeSurvey/LimeSurvey/pull/2627
LTS : https://github.com/LimeSurvey/LimeSurvey/pull/2626

Got lost here.
How https://github.com/LimeSurvey/LimeSurvey/pull/2627 is supposed to be tested?
Can you ellaborate a bit on the test case?

I guess html entities should be encoded on the DB, right?

I guess html entities should be encoded on the DB, right?

No…

1st issue : if you import CSV : no filter was done (you can save <script>alert("XSS")</script>, but when you edit you loose all HTML tag. When user register he can add HTML tag, but when edit via GUI : deleted.
The 1st commit disallow HTML tag in all situation : follow Admin GUI

But Carsten reopen issue because need to allow tag for admin user
The now

• Registering : disallow ALL tags (participant)
• Simple admin : via GUI/CPDB, remote or import (or plugins): allow tag but no XSS
• Super admin : via GUI/CPDB, remote or import (or plugins) : allow tag and XSS

Simple admin : via GUI/CPDB, remote or import (or plugins): allow tag but no XSS

What does it mean to allow tag but no XSS ?
Can you provide an example?
I thought we were testing if tags are allowed.
Sometimes we don't allow tags as they can allow XSS.
Right?

What does it mean to allow tag but no XSS ?

tag : HTML tag, i don't understand what is your problem here ?

Tag : <strong>strong</strong>
XSS : <script>alert('XSS')</script>

I thought we were testing if tags are allowed.

Yes, but must disallow XSS for simple admin.

Sometimes we don't allow tags as they can allow XSS.

We Always ALLOW html tag for question text or help …

Sometimes we don't allow tags as they can allow XSS.

We Always ALLOW html tag for question text or help …

https://manual.limesurvey.org/Global_settings/en#Security
I had the thought that regular users can't add HTML if Filter HTML for XSS is ON.
Maybe got confused.

I had the thought that regular users can't add HTML if Filter HTML for XSS is ON.

But yes : HTML tag allowed … for simple user in token attributes.

Tag != XSS

I really don't understand here …

You are right sorry. <script> tags are filtered! My bad.

;)

Maybe more clear like this :

• Registering : disallow ALL HTML (participant)
• Simple admin : via GUI/CPDB, remote or import (or plugins): allow HTML but activate XSS protection
• Super admin : via GUI/CPDB, remote or import (or plugins) : allow HTML without XSS protection

Simple admin : via GUI: don't allow tag, don't allow <script> tag

Why disallow HTML for admin ?

It's already merged in 3.X …

And see : https://github.com/LimeSurvey/LimeSurvey/pull/2627#pullrequestreview-1121944581 for master …

And https://github.com/LimeSurvey/LimeSurvey/pull/2627/files#r981147912

Why disallow HTML for admin ?

My mistake

Simple admin : via GUI/CPDB, remote or import (or plugins): allow HTML but activate XSS protection

Should this also apply for participants added directly to the survey (not through CPDB?) ?
If that's the case, it didn't work

Also, when participants are transferred from the CPDB to the survey, the tags are filtered.

Should this also apply for participants added directly to the survey (not through CPDB?) ?

I check with remote_co,ntrol : it work without any issue

Also, when participants are transferred from the CPDB to the survey, the tags are filtered.

No : it's OK …
It's only on attribute_X, not on firstname or lastname.

See screencast …

This is the test case run:

• Non superadmin
• Enter a participant in CPDB which contains tags (Ex: ) in the first name
• Copy the participant to a survey
• The tag in the participant was removed.
• Same participant, different First Name in survey vs CPDB.

It's only on attribute_X, not on firstname or lastname.

OH, ok. I was testing on the first name and last name as that was on the reproduction steps.
Maybe then I found another issue?

OH, ok. I was testing on the first name and last name as that was on the reproduction steps.
Maybe then I found another issue?

No : original issue was about whole : fitsname/lastname/attrute_X was not filtered when register, but only when edit via GUI.
Allowing on register create security issue. Allowing XSS create too security issue.
Since all HTML tag are totally filtered when edition : i use the same behaviour every wherer
The original issue was fixed a long time ago with : https://github.com/LimeSurvey/LimeSurvey/commit/e3c517f609d4ddc09acb90f2808762eb96d9428e removing all tag in all consition.

But @c_schmitz reopen the issue to allow superadmin to add tag on attributes : then it's the new PR  …
see https://bugs.limesurvey.org/view.php?id=16853#c71868

OK, I was trying to collaborate with the testing, but not sure I can add a lot more here.

Just to clarify, after my testing the participant on the CPDB and the participant on the survey had different first_name and last name.
CPDB: With allowed tags
Survey: No tags at all.

That was not expected (at least not by me :) ).

CPDB: With allowed tags
Survey: No tags at all.

Clearly another issue …

Must chek too if CPDB allow XSS for simple admin.

But : clearly : another issue to report …

Both PRs were merged now.