Commits on Apr 24, 2019

1. xss: XSS To LFI Vulnerability …

   This addresses a vulnerability found by [AkkuS CW](https://pentest.com.tr)
   where a simple XSS attempt can lead to an LFI (Local File Inclusion) attack.
   The issue stems from the system returning the unformatted file contents in
   an error message when uploading a CSV to the User Importer. This formats the
   contents before uploading so that if the contents are returned in an error
   message they will not be executed by the browser which therefore prevents
   XSS attempts and the possibility of an LFI attack. This also formats all the
   user-created data sent to ImportError to prevent the same issue.

   

   JediKev committed Apr 24, 2019
   Configuration menu

   • View commit details
   • Copy full SHA for eab6747
   • Browse repository at this point

   Copy the full SHA

   eab6747 View commit details

   Browse the repository at this point in the history