New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Backport #5570 - Immediate fix to htmlEncode user added text #5575

Merged
merged 2 commits into from Dec 21, 2018

Conversation

5 participants
@techknowlogick
Copy link
Member

techknowlogick commented Dec 21, 2018

There are likely problems remaining with the way that initCommentForm
is creating its elements. I suspect that a malformed avatar url could
be used maliciously.

#5570

Immediate fix to htmlEncode user added text
There are likely problems remaining with the way that initCommentForm
is creating its elements. I suspect that a malformed avatar url could
be used maliciously.

Signed-off-by: Matti Ranta <matti@mdranta.net>

@techknowlogick techknowlogick added this to the 1.6.2 milestone Dec 21, 2018

@techknowlogick techknowlogick requested review from lunny and zeripath Dec 21, 2018

@Bwko

Bwko approved these changes Dec 21, 2018

@bkcsoft bkcsoft added the lgtm/need 1 label Dec 21, 2018

@bkcsoft bkcsoft added lgtm/done and removed lgtm/need 1 labels Dec 21, 2018

@techknowlogick techknowlogick merged commit af4626a into go-gitea:release/v1.6 Dec 21, 2018

2 checks passed

approvals/lgtm this commit looks good
continuous-integration/drone/pr the build was successful
Details

@techknowlogick techknowlogick deleted the techknowlogick:backport-5570 branch Dec 21, 2018

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment