Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

There was a problem

You must be a member of this account.

Javascript Injection in Content

#31

Content should be scrubbed to prevent injection of javascript of any kind through ticker or dynamic content, XSS or otherwise.

Any scrubbing should be applied before going into the database, so that all output (screen, moderation/browse pages, and API) is clean.

This is a security hole that needs to be patched quickly.

Reported by Michael DiTore · September 3rd, 2009 @ 09:58 PM

State: resolved
Milestone: Concerto 1.9.1
Assigned to: nobody

Activity

  1. Michael DiTore
    Michael DiTore
    • State changed from new to resolved

    (from [661]) Prevent injection of HTML tags by encoding htmlspecialchars in ticker text and in content names (before writing to database). [#31 Javascript Injection in Content state:resolved]

    September 7th, 2009 @ 11:07 PM

  2. Brian Michalski
    Brian Michalski
    • Milestone order changed from 0 to 0

    February 3rd, 2012 @ 10:34 PM

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.