[
http://jira.magnolia-cms.com/browse/MAGNOLIA-3308?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=30434#action_30434
]
Felix Rabe commented on MAGNOLIA-3308:
--------------------------------------
Currently, if I change a value, it shows escaped as it should. If I
double-click on the value and then press the Enter or Escape key without
changing anything, it shows unescaped/rendered as I reported.
This is reproducible: change a value => it will be escaped; keep same value =>
it will not be escaped.
> HTML rendered / not escaped when entered in AdminCentral
> --------------------------------------------------------
>
> Key: MAGNOLIA-3308
> URL: http://jira.magnolia-cms.com/browse/MAGNOLIA-3308
> Project: Magnolia
> Issue Type: Bug
> Components: admininterface
> Affects Versions: 4.3.6
> Reporter: Felix Rabe
> Assignee: Philipp Bärfuss
>
> To reproduce this incorrect behaviour:
> * Choose any textual / HTML property in AdminCentral.
> * Double-click on its value.
> * If it does not contain any HTML yet, put some tag (like '<i>...</i>')
> around a word.
> * Either click on some other entry or press the Enter key to store the new
> value.
> Result: The new value will be rendered as HTML, e.g. the <i>word</i> will be
> italicized. (This is a mild case of cross-site scripting / XSS.)
> Expected: The new value should be shown as plain text.
> Possible reason: The value is not HTML escaped at some point or is escaped at
> the wrong point.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.magnolia-cms.com/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
----------------------------------------------------------------
For list details see
http://www.magnolia-cms.com/home/community/mailing-lists.html
To unsubscribe, E-mail to: <[email protected]>
----------------------------------------------------------------
