#31 ✓resolved
Michael DiTore

Javascript Injection in Content

Reported by Michael DiTore | September 3rd, 2009 @ 09:58 PM | in Concerto 1.9.1

Content should be scrubbed to prevent injection of javascript of any kind through ticker or dynamic content, XSS or otherwise.

Any scrubbing should be applied before going into the database, so that all output (screen, moderation/browse pages, and API) is clean.

This is a security hole that needs to be patched quickly.

Comments and changes to this ticket

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.

New-ticket Create new ticket

Create your profile

Help contribute to this project by taking a few moments to create your personal profile. Create your profile »

Concerto is an open source digital signage system that makes it easy to engage a large community of people with graphical and text-based announcements, bulletins, and other messages... but enough about us, you came here to get involved.
<br />
If you think you've <b>found a bug in Concerto</b>, please click 'Create new ticket' and let us know about it.
<br />
Looking to peek at our source code? Head to <a href="https://github.com/concerto/concerto_v1">https://github.com/concerto/concerto_v1</a> (Concerto version 1) or <a href="https://github.com/concerto/concerto">https://github.com/concerto/concerto</a> (Concerto version 2).
<br />
Our getting started guide is available here: <a href="https://github.com/concerto/concerto/wiki/Getting-Involved">https://github.com/concerto/concerto/wiki/Getting-Involved</a>.

People watching this ticket

Tags

Referenced by

Pages