[
https://issues.apache.org/roller/browse/ROL-1766?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14482#action_14482
]
Anil Gangolli commented on ROL-1766:
------------------------------------
Fix from trunk rev 668737 is integrated to branches/roller_4.0 branch in
revision 729448
http://svn.apache.org/viewvc?rev=729448&view=rev
> Cross-site scripting vulnerability in Roller search term treatment
> ------------------------------------------------------------------
>
> Key: ROL-1766
> URL: https://issues.apache.org/roller/browse/ROL-1766
> Project: Roller
> Issue Type: Bug
> Components: Search
> Affects Versions: 2.3, 3.0, 3.1, 4.0
> Environment: any
> Reporter: Anil Gangolli
> Assignee: Anil Gangolli
> Attachments: ROL-1766-weblog-vm.patch
>
>
> The search term submitted to Roller as the value of the "q" parameter on
> search requests (/search?q=query+terms) is echoed back in the default search
> form without escaping HTML tags.
> This can be converted to a cross-site scripting attack.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
