Security: XSS can be injected in the group edit view #151
Conversation
| // Prevent XSS injection | ||
| foreach($subsiteMap as $key => $map) { | ||
| $subsiteMap[$key] = Convert::raw2xml($map); | ||
| } |
There was a problem hiding this comment.
Don't need the loop. Just $subsiteMap = Convert::raw2xml($subsiteMap);
There was a problem hiding this comment.
True, I forgot that it can take an array type as well
|
Rebased.Removed the convert from |
|
Perhaps I'm wrong, but why isn't this a bug with the |
|
The templates should be escaping in CheckboxSetField might have a bug where it doesn't escape the label properly, though. |
|
Removed the escaping from the DropDownField, checkboxsetfield doesn't. For now I'm escaping the checkbox fields until we get this in framework. |
|
I'll merge this for now, and will have a look at fixing it in the core. |
Security: XSS can be injected in the group edit view
|
We can always change the behaviour in 3.2, since this module will need a separate for for that anyway. |
No description provided.