framadate issueshttps://framagit.org/framasoft/framadate/framadate/-/issues2021-05-14T11:53:31Zhttps://framagit.org/framasoft/framadate/framadate/-/issues/549db:migration:mysql:8 breaks pipeline2021-05-14T11:53:31ZFrédéric Souchondb:migration:mysql:8 breaks pipelineI made a fork to add a line in the MailService class. The pipeline breaks on db:migration:mysql:8I made a fork to add a line in the MailService class. The pipeline breaks on db:migration:mysql:8https://framagit.org/framasoft/framadate/framadate/-/issues/546XSS in markdown parsing in /create_poll.php2021-03-23T02:17:33ZmartgilXSS in markdown parsing in /create_poll.phpThere was an XSS on the current version of the framadate.
Prerequisite:
A local installation of framadate instance is needed.
Markdown Payload :
```
[Click Me](http://onclick=setTimeout`prompt\u0028document.domain\u0029`//)
```
Steps...There was an XSS on the current version of the framadate.
Prerequisite:
A local installation of framadate instance is needed.
Markdown Payload :
```
[Click Me](http://onclick=setTimeout`prompt\u0028document.domain\u0029`//)
```
Steps to reproduce:
1. Visit https://localhost/create_poll.php?type=date
2. Enter payload above.
3. Click on the preview. Then click the text link.
4. Javascript will execute.
Ps; Many websites are suffering with this XSS. I have reach you guys so It could be fixed really soon as It was suggested to me by those websites that are affected.
```
Hey,
- First of all, the website is running open source software that is developed by others, we are just using it. To have the biggest impact with your report, I suggest you notify the developers directly. Their website is at <https://framadate.org/>, their development is done here <https://framagit.org/framasoft/framadate>. This way, your report would be processed at the source of all installations.
Thanks again
```
I hope this could be fixed soon;
Best,1.1.15https://framagit.org/framasoft/framadate/framadate/-/issues/540bug in the checkMaxVotes () - proposal of a patch2021-03-02T09:44:42ZDid Gbug in the checkMaxVotes () - proposal of a patchHello,
I found a bug in the checkMaxVotes() function of the PollService.php file in the following use case:
- creation of a poll by date with a number of commitments limited to a value x.
- intervention of an administrator on a person's ...Hello,
I found a bug in the checkMaxVotes() function of the PollService.php file in the following use case:
- creation of a poll by date with a number of commitments limited to a value x.
- intervention of an administrator on a person's vote (modification of a commitment on a date)
The control of the maximum commitments does not take into account the own vote of the person being modified. In fact, the software blocks as soon as it finds a slot that has reached the maximum vote even if one of these votes is that of the user being modified.
The bug can be corrected as follows:
```
* This method checks if the votes doesn't conflicts the maximum votes constraint
* @param $ user_choice
* @param \ stdClass $ poll
* @param string $ poll_id
* @throws ConcurrentVoteException
* /
//private function checkMaxVotes ($user_choice, $poll, $poll_id) {
private function checkMaxVotes ($user_choice, $poll, $poll_id, $vote_id) {
$ votes = $ this-> allVotesByPollId ($ poll_id);
if (count ($ votes) <= 0) {
return;
}
// look for the existing polls of the user who would like to change them
$count = 0; // init counter
$user_considere = 0; // init id user to consider
foreach ($votes as $v){
if ($v-> id == $vote_id){
$user_considere = $count;
}
else $count ++;
}
$best_choices = $this-> computeBestChoices ($votes, $poll);
foreach ($best_choices ['y'] as $i => $nb_choice) {
// if for this option we have reached maximum value and user wants to add itself too
$ch = substr ($votes [$user_considere] -> choices, $i, 1);
// if ($ poll-> ValueMax! == null && $ nb_choice> = $ poll-> ValueMax && $ user_choice [$ i] === "2") {
if ($poll-> ValueMax! == null && $nb_choice> = $poll-> ValueMax && $user_choice [$i] === "2" && $ch! = "2") {// if we reached the maximum values and the user poll is 2 and the previous poll was not 2 => not possible else ok
throw new ConcurrentVoteException ();
}
}
}
}```
thank's for allhttps://framagit.org/framasoft/framadate/framadate/-/issues/530Erreur 500 - nom de l'auteur du sondage trop long2022-07-04T14:03:30ZLapineigeErreur 500 - nom de l'auteur du sondage trop longBonjour,
En essayant de créer un sondage, j'ai remarqué un problème qui génère une erreur 500 au moment de la confirmation (ou de l'édition) du sondage, si:
- le nom est trop long (environ >50 caractères)
- le nom contient une apostroph...Bonjour,
En essayant de créer un sondage, j'ai remarqué un problème qui génère une erreur 500 au moment de la confirmation (ou de l'édition) du sondage, si:
- le nom est trop long (environ >50 caractères)
- le nom contient une apostrophe
Je n'ai pas eu le temps de vérifier quel cas était problématique (désolé…), mon problème venait d'un nom long comportant une apostrophe.1.1.14