Javascript Injection in Content
Reported by Michael DiTore | September 3rd, 2009 @ 09:58 PM | in Concerto 1.9.1
Content should be scrubbed to prevent injection of javascript of any kind through ticker or dynamic content, XSS or otherwise.
Any scrubbing should be applied before going into the database, so that all output (screen, moderation/browse pages, and API) is clean.
This is a security hole that needs to be patched quickly.
Comments and changes to this ticket
-
Michael DiTore September 7th, 2009 @ 11:07 PM
- State changed from new to resolved
-
Brian Michalski February 3rd, 2012 @ 10:34 PM
- Milestone order changed from 0 to 0
(from [f8cc7d57664fbaaa8e03aa84689a45d5ed78da25]) Hide parent feed selector when there are no feeds. Closes #31. https://github.com/concerto/concerto/commit/f8cc7d57664fbaaa8e03aa8...
Please Sign in or create a free account to add a new ticket.
With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.
Create your profile
Help contribute to this project by taking a few moments to create your personal profile. Create your profile ยป
Concerto is an open source digital signage system that makes it easy to engage a large community of people with graphical and text-based announcements, bulletins, and other messages... but enough about us, you came here to get involved.
<br />
If you think you've <b>found a bug in Concerto</b>, please click 'Create new ticket' and let us know about it.
<br />
Looking to peek at our source code? Head to <a href="https://github.com/concerto/concerto_v1">https://github.com/concerto/concerto_v1</a> (Concerto version 1) or <a href="https://github.com/concerto/concerto">https://github.com/concerto/concerto</a> (Concerto version 2).
<br />
Our getting started guide is available here: <a href="https://github.com/concerto/concerto/wiki/Getting-Involved">https://github.com/concerto/concerto/wiki/Getting-Involved</a>.
People watching this ticket
Tags
Referenced by
- 31 Javascript Injection in Content (from [661]) Prevent injection of HTML tags by encoding h...