Skip to content

Release Notes

Compare
Choose a tag to compare
@rgrebenchuk rgrebenchuk released this 22 Sep 12:58
· 11631 commits to master since this release

Stored XSS Vulnerability fixes

* added "|json_encode|raw" for values outputted in JS objects
* removed "|raw" from outputs of path in url attributes
* added "e('html_attr')|raw" when outputting html attributes
* removed mentions of "flexible entity" and unused code
* added validator for css field of embedded form, now if user will enter html tags in this field he will get an error message
* added stiptags filter for css of embedded forms
* changed translation message oro.entity_config.records_count.label to contain placeholder of records count and use UI.link macros in template instead of slicing str
* changed method of validation of emails on the client, old validation was working very slowly with some values like '">< img src=d onerror=confirm(/provensec/);>', n
* removed "trans|raw" where it's not required
* minor changes in templates to improve readability
* added Email validator for Lead
* fixed XSS vulnerability in Leads, Case Comments, Notes, Embedded forms, Emails, Business Units, Breadcrumbs
* fixed escaping of page title