CVE-2013-0234: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in the Twitter widget in Elgg before 1.7.17 and 1.8.x before 1.8.13 allows remote attackers to inject arbitrary web script or HTML via the params[twitter_username] parameter to action/widgets/save.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-02-02T20:55Z
Repository: https://github.com/Elgg/Elgg
Language: PHP
Files changed: README.md, mod/twitter/languages/en.php, version.php
Commit date: 2013-01-26 15:39:06 -0500
Commit message: Merged 1.8.13 release into master

Conflicts:
	README.md
	mod/twitter/languages/en.php
	version.php

Diff: diff --cc README.md
index ba5c452b9,dd604fd2b..ea952b62e
--- a/README.md
+++ b/README.md
@@@ -1,11 -1,9 +1,11 @@@
 -Elgg
 -Copyright (c) 2008-2013 See COPYRIGHT.txt
 +Elgg [![Build Status](https://secure.travis-ci.org/Elgg/Elgg.png?branch=master)](https://travis-ci.org/Elgg/Elgg)
 +====
  
- Copyright (c) 2008-2012, see COPYRIGHT.txt
 -See CONTRIBUTORS.txt for development credits.
++Copyright (c) 2008-2013, see COPYRIGHT.txt
 +
 +For development credits, see CONTRIBUTORS.txt.
  
  Elgg is managed by the Elgg Foundation, a nonprofit organization that was
  founded to govern, protect, and promote the Elgg open source social network
  engine.  The Foundation aims to provide a stable, commercially and
  individually independent organization that operates in the best interest of Elgg
diff --cc mod/twitter/languages/en.php
index dd7bbf56b,11e745ba1..fcddfcddf
--- a/mod/twitter/languages/en.php
+++ b/mod/twitter/languages/en.php
@@@ -1,14 -1,17 +1,16 @@@
  <?php
  /**
   * Twitter widget language file
   */
  
 -$english = array(
 +return array(
 +
  	'twitter:title' => 'Twitter',
  	'twitter:info' => 'Display your latest tweets',
- 	'twitter:username' => 'Enter your twitter username.',
- 	'twitter:num' => 'The number of tweets to show.',
+ 	'twitter:username' => 'Your twitter username',
+ 	'twitter:num' => 'Number of tweets to show*',
  	'twitter:visit' => 'visit my twitter',
- 	'twitter:notset' => 'This Twitter widget is not yet set to go. To display your latest tweets, click on - edit - and fill in your details',
+ 	'twitter:notset' => 'This widget needs to be configured. To display your latest tweets, click the customize icon and fill in your Twitter username.',
+ 	'twitter:invalid' => 'This widget is configured with an invalid Twitter username. Click the customize icon to correct it.',
+ 	'twitter:apibug' => "*Due to a bug in the Twitter 1.0 API, you may see fewer tweets than you ask for.",
  );
 -
 -add_translation("en", $english);
diff --cc version.php
index 07e854f8e,07a08ab4a..f7962f0cd
--- a/version.php
+++ b/version.php
@@@ -9,9 -9,9 +9,9 @@@
   * @subpackage Core
   */
  
  // YYYYMMDD = Elgg Date
  // XX = Interim incrementer
- $version = 2011110700;
 -$version = 2013012900;
++$version = 2013012600;
  
  // Human-friendly version name
 -$release = '1.8.13';
 +$release = '1.9.0-dev';

Vulnerable code:  Copyright (c) 2008-2012, see COPYRIGHT.txt
 	'twitter:username' => 'Enter your twitter username.',
 	'twitter:num' => 'The number of tweets to show.',
 	'twitter:notset' => 'This Twitter widget is not yet set to go. To display your latest tweets, click on - edit - and fill in your details',
 $version = 2011110700;
Fixed code: +Copyright (c) 2008-2013, see COPYRIGHT.txt
 	'twitter:username' => 'Your twitter username',
 	'twitter:num' => 'Number of tweets to show*',
 	'twitter:notset' => 'This widget needs to be configured. To display your latest tweets, click the customize icon and fill in your Twitter username.',
 	'twitter:invalid' => 'This widget is configured with an invalid Twitter username. Click the customize icon to correct it.',
 	'twitter:apibug' => "*Due to a bug in the Twitter 1.0 API, you may see fewer tweets than you ask for.",
+$version = 2013012600;