[ https://issues.apache.org/jira/browse/OFBIZ-10054?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Jacques Le Roux reassigned OFBIZ-10054: --------------------------------------- Assignee: Jacques Le Roux > Product content management screen doesn't validate trusted users' input > ----------------------------------------------------------------------- > > Key: OFBIZ-10054 > URL: https://issues.apache.org/jira/browse/OFBIZ-10054 > Project: OFBiz > Issue Type: Improvement > Components: product > Affects Versions: Trunk, Release Branch 16.11 > Reporter: Jacopo Cappellato > Assignee: Jacques Le Roux > Priority: Major > > Steps to recreate: > 1) go to (authenticate with admin/ofbiz): > https://localhost:8443/catalog/control/EditProductContent?productId=WG-1111 > 2) set the content of the field labeled "Large Image" to: > non_existent.foo" onerror="alert('Hi!'); > 3) visit the url: > https://localhost:8443/ecommerce/control/product?product_id=WG-1111 > A popup message will appear with the "Hi!". > Thanks to Loris Nardo for the report. -- This message was sent by Atlassian JIRA (v7.6.3#76005)