HTML rendered / not escaped when entered in AdminCentral
--------------------------------------------------------
Key: MAGNOLIA-3308
URL: http://jira.magnolia-cms.com/browse/MAGNOLIA-3308
Project: Magnolia
Issue Type: Bug
Components: admininterface
Affects Versions: 4.3.6
Reporter: Felix Rabe
Assignee: Philipp Bärfuss
To reproduce this incorrect behaviour:
* Choose any textual / HTML property in AdminCentral.
* Double-click on its value.
* If it does not contain any HTML yet, put some tag (like '<i>...</i>') around
a word.
* Either click on some other entry or press the Enter key to store the new
value.
Result: The new value will be rendered as HTML, e.g. the <i>word</i> will be
italicized. (This is a mild case of cross-site scripting / XSS.)
Expected: The new value should be shown as plain text.
Possible reason: The value is not HTML escaped at some point or is escaped at
the wrong point.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.magnolia-cms.com/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
----------------------------------------------------------------
For list details see
http://www.magnolia-cms.com/home/community/mailing-lists.html
To unsubscribe, E-mail to: <[email protected]>
----------------------------------------------------------------
