{"action":"closed","issue":{"url":"https://api.github.com/repos/owncloud/gallery/issues/445","repository_url":"https://api.github.com/repos/owncloud/gallery","labels_url":"https://api.github.com/repos/owncloud/gallery/issues/445/labels{/name}","comments_url":"https://api.github.com/repos/owncloud/gallery/issues/445/comments","events_url":"https://api.github.com/repos/owncloud/gallery/issues/445/events","html_url":"https://github.com/owncloud/gallery/issues/445","id":112158698,"number":445,"title":"gallery.cnf is not verifying \"sort\" button","user":{"login":"LukasReschke","id":878997,"avatar_url":"https://avatars.githubusercontent.com/u/878997?v=3","gravatar_id":"","url":"https://api.github.com/users/LukasReschke","html_url":"https://github.com/LukasReschke","followers_url":"https://api.github.com/users/LukasReschke/followers","following_url":"https://api.github.com/users/LukasReschke/following{/other_user}","gists_url":"https://api.github.com/users/LukasReschke/gists{/gist_id}","starred_url":"https://api.github.com/users/LukasReschke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/LukasReschke/subscriptions","organizations_url":"https://api.github.com/users/LukasReschke/orgs","repos_url":"https://api.github.com/users/LukasReschke/repos","events_url":"https://api.github.com/users/LukasReschke/events{/privacy}","received_events_url":"https://api.github.com/users/LukasReschke/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/owncloud/gallery/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/owncloud/gallery/labels/security","name":"security","color":"fc2929"}],"state":"closed","locked":false,"assignee":{"login":"oparoz","id":323220,"avatar_url":"https://avatars.githubusercontent.com/u/323220?v=3","gravatar_id":"","url":"https://api.github.com/users/oparoz","html_url":"https://github.com/oparoz","followers_url":"https://api.github.com/users/oparoz/followers","following_url":"https://api.github.com/users/oparoz/following{/other_user}","gists_url":"https://api.github.com/users/oparoz/gists{/gist_id}","starred_url":"https://api.github.com/users/oparoz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/oparoz/subscriptions","organizations_url":"https://api.github.com/users/oparoz/orgs","repos_url":"https://api.github.com/users/oparoz/repos","events_url":"https://api.github.com/users/oparoz/events{/privacy}","received_events_url":"https://api.github.com/users/oparoz/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/owncloud/gallery/milestones/14","html_url":"https://github.com/owncloud/gallery/milestones/9.0-current","labels_url":"https://api.github.com/repos/owncloud/gallery/milestones/14/labels","id":1226544,"number":14,"title":"9.0-current","description":"","creator":{"login":"oparoz","id":323220,"avatar_url":"https://avatars.githubusercontent.com/u/323220?v=3","gravatar_id":"","url":"https://api.github.com/users/oparoz","html_url":"https://github.com/oparoz","followers_url":"https://api.github.com/users/oparoz/followers","following_url":"https://api.github.com/users/oparoz/following{/other_user}","gists_url":"https://api.github.com/users/oparoz/gists{/gist_id}","starred_url":"https://api.github.com/users/oparoz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/oparoz/subscriptions","organizations_url":"https://api.github.com/users/oparoz/orgs","repos_url":"https://api.github.com/users/oparoz/repos","events_url":"https://api.github.com/users/oparoz/events{/privacy}","received_events_url":"https://api.github.com/users/oparoz/received_events","type":"User","site_admin":false},"open_issues":9,"closed_issues":26,"state":"open","created_at":"2015-07-26T22:29:05Z","updated_at":"2016-02-14T20:20:49Z","due_on":"2016-03-08T04:00:00Z","closed_at":null},"comments":17,"created_at":"2015-10-19T14:37:11Z","updated_at":"2016-02-14T20:20:49Z","closed_at":"2016-02-14T20:20:49Z","body":"Data such as \"type\" is not checked properly, due to some hardening in core this does not lead directly to an exploitable XSS but should get addressed anyways.\r\n\r\n![2015-10-19_16-36-49](https://cloud.githubusercontent.com/assets/878997/10580804/9e0e67be-767f-11e5-847a-f2cd2ae395c7.png)\r\n\r\nRelated code: https://github.com/owncloud/gallery/blob/d904a6a4af293e5730e397218c7e0713c3461215/js/galleryview.js#L322\r\n\r\nProbably we should verify in the controller and also in the JS for data from the gallery config.\r\n\r\n<bountysource-plugin>\r\n---\r\nWant to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/27523251-gallery-cnf-is-not-verifying-sort-button?utm_campaign=plugin&utm_content=tracker%2F9328526&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F9328526&utm_medium=issues&utm_source=github).\r\n</bountysource-plugin>"}}