| 11:57.45 | *** join/#asterisk-doc ctooley (~ctooley@c-98-193-232-154.hsd1.tn.comcast.net) |
| 14:58.13 | seanbright | so apparently that dtmf problem was purely my cell phone |
| 14:58.23 | seanbright | works fine everywhere else i've tested |
| 14:58.25 | seanbright | shrugs |
| 14:58.54 | file | inband DTMF, it's fun |
| 14:59.37 | seanbright | looks to be a common issue with iphones |
| 15:00.17 | seanbright | or at least it looks like others have similar issues |
| 15:01.53 | seanbright | and turning off 3g on my phone fixes it? hrmm. |
| 15:05.46 | seanbright | sure enough. |
| 15:24.35 | *** join/#asterisk-doc jasonjjohnsonjr (~jasonjjoh@asa1.jsmc.org) |
| 15:41.08 | *** join/#asterisk-doc jasonjjohnsonjr (~jasonjjoh@asa1.jsmc.org) |
| 16:35.45 | *** join/#asterisk-doc jasonjjohnsonjr (~jasonjjoh@asa1.jsmc.org) |
| 16:36.03 | *** part/#asterisk-doc jasonjjohnsonjr (~jasonjjoh@asa1.jsmc.org) |
| 16:36.14 | *** join/#asterisk-doc jasonjjohnsonjr (~jasonjjoh@asa1.jsmc.org) |
| 18:52.02 | *** join/#asterisk-doc leifmadsen (~Leif@asterisk/documenteur-extraordinaire/blitzrage) |
| 18:52.02 | *** mode/#asterisk-doc [+o leifmadsen] by ChanServ |
| 19:13.04 | leifmadsen | *facepalms* at ward mundy |
| 19:14.32 | file | what now? |
| 19:16.14 | seanbright | i can probably guess |
| 19:16.26 | seanbright | something to do with no longer supporting 1.6.0 and 1.6.1? |
| 19:19.14 | seanbright | leifmadsen: i must know |
| 19:24.01 | leifmadsen | no, let my type out his argument |
| 19:25.45 | leifmadsen | A person is sending a SIP request to Asterisk and Asterisk is writing that data to MySQL. The data coming from the From header happens to have data (which is valid in the SIP header) but happens to contain a series of characters that, when read by another application from the MySQL database is vulnerable to a XSS attack. His argument is that Asterisk should have sanitized that data so the reader wasn't vulnerable inst |
| 19:25.46 | leifmadsen | ead of the reader who happens to be reading that data to be fixed. |
| 19:26.18 | leifmadsen | Every single person on this VUC call is arguing the reader is at fault because Asterisk is not affected by anything. |
| 19:26.37 | leifmadsen | Except Ward continues to say Asterisk should be sanitizing the data (how? no idea) |
| 19:27.01 | seanbright | like the from header contains --; or something? |
| 19:27.13 | seanbright | --; delete from tablename; |
| 19:27.13 | leifmadsen | it contains some string that allows JavaScript to do something nasty |
| 19:27.18 | seanbright | oh |
| 19:27.42 | leifmadsen | the AJAX log viewer is susceptible to the data that Asterisk writes to the log file |
| 19:28.00 | seanbright | ah... i see |
| 19:28.18 | leifmadsen | he's a fucking nub |
| 19:28.21 | leifmadsen | he's pissing me off |
| 19:28.22 | seanbright | heh |
| 19:28.29 | seanbright | pbx in a flash! |
| 19:28.31 | seanbright | bam! |
| 19:28.34 | seanbright | FLASH! |
| 19:28.38 | leifmadsen | he's really pissing me off |
| 19:28.43 | seanbright | heh |
| 19:28.48 | leifmadsen | I'm done talking about this now |
| 19:29.02 | seanbright | want me to have him killed? |
| 19:29.07 | seanbright | sorry, that was supposed to be a /msg |
| 19:29.31 | leifmadsen | yes I do |
| 19:29.36 | leifmadsen | that wasn't supposed to be a /msg |
| 19:30.27 | seanbright | :-) |
| 21:57.33 | *** part/#asterisk-doc jasonjjohnsonjr (~jasonjjoh@asa1.jsmc.org) |
| 23:28.27 | *** join/#asterisk-doc fabi (~fabi@91.204.180.233) |
| 23:29.51 | *** part/#asterisk-doc fabi (~fabi@91.204.180.233) |