{"action":"opened","number":12884,"pull_request":{"url":"https://api.github.com/repos/modxcms/revolution/pulls/12884","id":57420995,"html_url":"https://github.com/modxcms/revolution/pull/12884","diff_url":"https://github.com/modxcms/revolution/pull/12884.diff","patch_url":"https://github.com/modxcms/revolution/pull/12884.patch","issue_url":"https://api.github.com/repos/modxcms/revolution/issues/12884","number":12884,"state":"open","locked":false,"title":"Proposed fix to bug https://github.com/modxcms/revolution/issues/12835","user":{"login":"yoleg","id":539742,"avatar_url":"https://avatars.githubusercontent.com/u/539742?v=3","gravatar_id":"","url":"https://api.github.com/users/yoleg","html_url":"https://github.com/yoleg","followers_url":"https://api.github.com/users/yoleg/followers","following_url":"https://api.github.com/users/yoleg/following{/other_user}","gists_url":"https://api.github.com/users/yoleg/gists{/gist_id}","starred_url":"https://api.github.com/users/yoleg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yoleg/subscriptions","organizations_url":"https://api.github.com/users/yoleg/orgs","repos_url":"https://api.github.com/users/yoleg/repos","events_url":"https://api.github.com/users/yoleg/events{/privacy}","received_events_url":"https://api.github.com/users/yoleg/received_events","type":"User","site_admin":false},"body":"Rebase for https://github.com/modxcms/revolution/pull/12874\r\n \r\nThis fixes a bug that can expose user-submitted form data and other user-specific or request-specific data to the public, particularly in sites that use many nesting levels of elements. See https://github.com/modxcms/revolution/issues/12835\r\n \r\nBecause this fix changes the tag-parsing order, this might cause some sites with\r\ncomplex tag nesting to experience bugs as a result of even more complex tag nesting.\r\nThis is probably not a result of this fix but is a result of the different tag parsing\r\norder. The parsing order changes because uncached tags vulnerable to\r\nthe bug will now remain unparsed until the next parsing pass. Thus, a system\r\nsetting is needed to allow sites to disable this fix temporarily on production sites.\r\n\r\nAlso, parsing speed may decrease. Again, this is not a result of this fix but a result of the unparsed tags that are vulnerable to this bug getting their parsing delayed until the next pass.\r\n \r\nSites that do not have any vulnerable unparsed elements should remain unaffected by this fix, but testing is recommended. ","created_at":"2016-01-27T20:54:11Z","updated_at":"2016-01-27T20:54:11Z","closed_at":null,"merged_at":null,"merge_commit_sha":"265647eca30d7cc2989fd73542af4a0e024c68cd","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/modxcms/revolution/pulls/12884/commits","review_comments_url":"https://api.github.com/repos/modxcms/revolution/pulls/12884/comments","review_comment_url":"https://api.github.com/repos/modxcms/revolution/pulls/comments{/number}","comments_url":"https://api.github.com/repos/modxcms/revolution/issues/12884/comments","statuses_url":"https://api.github.com/repos/modxcms/revolution/statuses/eaa4ff758b5fc9022d0622ad30d1dbb6c3e29dd0","head":{"label":"yoleg:hotfix-yoleg","ref":"hotfix-yoleg","sha":"eaa4ff758b5fc9022d0622ad30d1dbb6c3e29dd0","user":{"login":"yoleg","id":539742,"avatar_url":"https://avatars.githubusercontent.com/u/539742?v=3","gravatar_id":"","url":"https://api.github.com/users/yoleg","html_url":"https://github.com/yoleg","followers_url":"https://api.github.com/users/yoleg/followers","following_url":"https://api.github.com/users/yoleg/following{/other_user}","gists_url":"https://api.github.com/users/yoleg/gists{/gist_id}","starred_url":"https://api.github.com/users/yoleg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yoleg/subscriptions","organizations_url":"https://api.github.com/users/yoleg/orgs","repos_url":"https://api.github.com/users/yoleg/repos","events_url":"https://api.github.com/users/yoleg/events{/privacy}","received_events_url":"https://api.github.com/users/yoleg/received_events","type":"User","site_admin":false},"repo":{"id":5325018,"name":"revolution","full_name":"yoleg/revolution","owner":{"login":"yoleg","id":539742,"avatar_url":"https://avatars.githubusercontent.com/u/539742?v=3","gravatar_id":"","url":"https://api.github.com/users/yoleg","html_url":"https://github.com/yoleg","followers_url":"https://api.github.com/users/yoleg/followers","following_url":"https://api.github.com/users/yoleg/following{/other_user}","gists_url":"https://api.github.com/users/yoleg/gists{/gist_id}","starred_url":"https://api.github.com/users/yoleg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yoleg/subscriptions","organizations_url":"https://api.github.com/users/yoleg/orgs","repos_url":"https://api.github.com/users/yoleg/repos","events_url":"https://api.github.com/users/yoleg/events{/privacy}","received_events_url":"https://api.github.com/users/yoleg/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/yoleg/revolution","description":"MODx Revolution - Content Application Platform","fork":true,"url":"https://api.github.com/repos/yoleg/revolution","forks_url":"https://api.github.com/repos/yoleg/revolution/forks","keys_url":"https://api.github.com/repos/yoleg/revolution/keys{/key_id}","collaborators_url":"https://api.github.com/repos/yoleg/revolution/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/yoleg/revolution/teams","hooks_url":"https://api.github.com/repos/yoleg/revolution/hooks","issue_events_url":"https://api.github.com/repos/yoleg/revolution/issues/events{/number}","events_url":"https://api.github.com/repos/yoleg/revolution/events","assignees_url":"https://api.github.com/repos/yoleg/revolution/assignees{/user}","branches_url":"https://api.github.com/repos/yoleg/revolution/branches{/branch}","tags_url":"https://api.github.com/repos/yoleg/revolution/tags","blobs_url":"https://api.github.com/repos/yoleg/revolution/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/yoleg/revolution/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/yoleg/revolution/git/refs{/sha}","trees_url":"https://api.github.com/repos/yoleg/revolution/git/trees{/sha}","statuses_url":"https://api.github.com/repos/yoleg/revolution/statuses/{sha}","languages_url":"https://api.github.com/repos/yoleg/revolution/languages","stargazers_url":"https://api.github.com/repos/yoleg/revolution/stargazers","contributors_url":"https://api.github.com/repos/yoleg/revolution/contributors","subscribers_url":"https://api.github.com/repos/yoleg/revolution/subscribers","subscription_url":"https://api.github.com/repos/yoleg/revolution/subscription","commits_url":"https://api.github.com/repos/yoleg/revolution/commits{/sha}","git_commits_url":"https://api.github.com/repos/yoleg/revolution/git/commits{/sha}","comments_url":"https://api.github.com/repos/yoleg/revolution/comments{/number}","issue_comment_url":"https://api.github.com/repos/yoleg/revolution/issues/comments{/number}","contents_url":"https://api.github.com/repos/yoleg/revolution/contents/{+path}","compare_url":"https://api.github.com/repos/yoleg/revolution/compare/{base}...{head}","merges_url":"https://api.github.com/repos/yoleg/revolution/merges","archive_url":"https://api.github.com/repos/yoleg/revolution/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/yoleg/revolution/downloads","issues_url":"https://api.github.com/repos/yoleg/revolution/issues{/number}","pulls_url":"https://api.github.com/repos/yoleg/revolution/pulls{/number}","milestones_url":"https://api.github.com/repos/yoleg/revolution/milestones{/number}","notifications_url":"https://api.github.com/repos/yoleg/revolution/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/yoleg/revolution/labels{/name}","releases_url":"https://api.github.com/repos/yoleg/revolution/releases{/id}","deployments_url":"https://api.github.com/repos/yoleg/revolution/deployments","created_at":"2012-08-07T07:46:35Z","updated_at":"2013-02-20T16:59:58Z","pushed_at":"2016-01-27T20:38:58Z","git_url":"git://github.com/yoleg/revolution.git","ssh_url":"git@github.com:yoleg/revolution.git","clone_url":"https://github.com/yoleg/revolution.git","svn_url":"https://github.com/yoleg/revolution","homepage":"http://rtfm.modx.com/display/revolution","size":45360,"stargazers_count":0,"watchers_count":0,"language":"PHP","has_issues":false,"has_downloads":false,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"develop"}},"base":{"label":"modxcms:2.4.x","ref":"2.4.x","sha":"9c8771b9209c33a31316dc1634c4065459cf3e82","user":{"login":"modxcms","id":232723,"avatar_url":"https://avatars.githubusercontent.com/u/232723?v=3","gravatar_id":"","url":"https://api.github.com/users/modxcms","html_url":"https://github.com/modxcms","followers_url":"https://api.github.com/users/modxcms/followers","following_url":"https://api.github.com/users/modxcms/following{/other_user}","gists_url":"https://api.github.com/users/modxcms/gists{/gist_id}","starred_url":"https://api.github.com/users/modxcms/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/modxcms/subscriptions","organizations_url":"https://api.github.com/users/modxcms/orgs","repos_url":"https://api.github.com/users/modxcms/repos","events_url":"https://api.github.com/users/modxcms/events{/privacy}","received_events_url":"https://api.github.com/users/modxcms/received_events","type":"Organization","site_admin":false},"repo":{"id":806201,"name":"revolution","full_name":"modxcms/revolution","owner":{"login":"modxcms","id":232723,"avatar_url":"https://avatars.githubusercontent.com/u/232723?v=3","gravatar_id":"","url":"https://api.github.com/users/modxcms","html_url":"https://github.com/modxcms","followers_url":"https://api.github.com/users/modxcms/followers","following_url":"https://api.github.com/users/modxcms/following{/other_user}","gists_url":"https://api.github.com/users/modxcms/gists{/gist_id}","starred_url":"https://api.github.com/users/modxcms/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/modxcms/subscriptions","organizations_url":"https://api.github.com/users/modxcms/orgs","repos_url":"https://api.github.com/users/modxcms/repos","events_url":"https://api.github.com/users/modxcms/events{/privacy}","received_events_url":"https://api.github.com/users/modxcms/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/modxcms/revolution","description":"MODX Revolution - Content Application Platform","fork":false,"url":"https://api.github.com/repos/modxcms/revolution","forks_url":"https://api.github.com/repos/modxcms/revolution/forks","keys_url":"https://api.github.com/repos/modxcms/revolution/keys{/key_id}","collaborators_url":"https://api.github.com/repos/modxcms/revolution/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/modxcms/revolution/teams","hooks_url":"https://api.github.com/repos/modxcms/revolution/hooks","issue_events_url":"https://api.github.com/repos/modxcms/revolution/issues/events{/number}","events_url":"https://api.github.com/repos/modxcms/revolution/events","assignees_url":"https://api.github.com/repos/modxcms/revolution/assignees{/user}","branches_url":"https://api.github.com/repos/modxcms/revolution/branches{/branch}","tags_url":"https://api.github.com/repos/modxcms/revolution/tags","blobs_url":"https://api.github.com/repos/modxcms/revolution/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/modxcms/revolution/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/modxcms/revolution/git/refs{/sha}","trees_url":"https://api.github.com/repos/modxcms/revolution/git/trees{/sha}","statuses_url":"https://api.github.com/repos/modxcms/revolution/statuses/{sha}","languages_url":"https://api.github.com/repos/modxcms/revolution/languages","stargazers_url":"https://api.github.com/repos/modxcms/revolution/stargazers","contributors_url":"https://api.github.com/repos/modxcms/revolution/contributors","subscribers_url":"https://api.github.com/repos/modxcms/revolution/subscribers","subscription_url":"https://api.github.com/repos/modxcms/revolution/subscription","commits_url":"https://api.github.com/repos/modxcms/revolution/commits{/sha}","git_commits_url":"https://api.github.com/repos/modxcms/revolution/git/commits{/sha}","comments_url":"https://api.github.com/repos/modxcms/revolution/comments{/number}","issue_comment_url":"https://api.github.com/repos/modxcms/revolution/issues/comments{/number}","contents_url":"https://api.github.com/repos/modxcms/revolution/contents/{+path}","compare_url":"https://api.github.com/repos/modxcms/revolution/compare/{base}...{head}","merges_url":"https://api.github.com/repos/modxcms/revolution/merges","archive_url":"https://api.github.com/repos/modxcms/revolution/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/modxcms/revolution/downloads","issues_url":"https://api.github.com/repos/modxcms/revolution/issues{/number}","pulls_url":"https://api.github.com/repos/modxcms/revolution/pulls{/number}","milestones_url":"https://api.github.com/repos/modxcms/revolution/milestones{/number}","notifications_url":"https://api.github.com/repos/modxcms/revolution/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/modxcms/revolution/labels{/name}","releases_url":"https://api.github.com/repos/modxcms/revolution/releases{/id}","deployments_url":"https://api.github.com/repos/modxcms/revolution/deployments","created_at":"2010-07-29T21:03:57Z","updated_at":"2016-01-26T09:35:06Z","pushed_at":"2016-01-27T20:54:12Z","git_url":"git://github.com/modxcms/revolution.git","ssh_url":"git@github.com:modxcms/revolution.git","clone_url":"https://github.com/modxcms/revolution.git","svn_url":"https://github.com/modxcms/revolution","homepage":"http://rtfm.modx.com/revolution/2.x/","size":67217,"stargazers_count":726,"watchers_count":726,"language":"PHP","has_issues":true,"has_downloads":false,"has_wiki":false,"has_pages":false,"forks_count":384,"mirror_url":null,"open_issues_count":890,"forks":384,"open_issues":890,"watchers":726,"default_branch":"2.x"}},"_links":{"self":{"href":"https://api.github.com/repos/modxcms/revolution/pulls/12884"},"html":{"href":"https://github.com/modxcms/revolution/pull/12884"},"issue":{"href":"https://api.github.com/repos/modxcms/revolution/issues/12884"},"comments":{"href":"https://api.github.com/repos/modxcms/revolution/issues/12884/comments"},"review_comments":{"href":"https://api.github.com/repos/modxcms/revolution/pulls/12884/comments"},"review_comment":{"href":"https://api.github.com/repos/modxcms/revolution/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/modxcms/revolution/pulls/12884/commits"},"statuses":{"href":"https://api.github.com/repos/modxcms/revolution/statuses/eaa4ff758b5fc9022d0622ad30d1dbb6c3e29dd0"}},"merged":false,"mergeable":true,"mergeable_state":"clean","merged_by":null,"comments":0,"review_comments":0,"commits":1,"additions":18,"deletions":0,"changed_files":1}}