Archived Setups - title of archived setup is not properly escaped

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 6.1.0 CE RC1
• Fix Version/s: 6.1.0 CE RC1, --Sprint 11/12, 6.2.0 CE M2
• Component/s: Security
• Labels:
  • bugsquad
• Environment: Tomcat 7.0.22. + MySQL 5. 6.1.x Revision: 93508.
• Story Points: 2
• Fix Priority: 4
• Similar Issues: Show 4 results ; ;

  LPS-13724	Configurations saved as an 'Archived Setup' do not 'Restore' properly in the 'Shopping Portlet'.
  LPS-5757	Portlet Archived Setups are not shown after being imported from LAR
  LPS-1033	Asset Publisher - Archived Setup Bug
  LPS-15918	List and load Archived portlet setups from the Add Application menu

1. add asset publisher to a page
2. go to Configuration -> Setup
3. go to Archive/Restore Setup
4. save your setup as <script>alert("www.eo.pl");</script
   Effect: almost immediately you will see javascript error because HTML in that name was not escaped. This is security bug.

[Paul Piao]

Hi Szymon,
Thank you for your report. I was able to reproduce this issue in 6.1.0 B3. I have also tested this issue on trunk revision 93508 and I was also reproduce. I will update the this ticket to reflect the issue.

[Kiyoshi Lee]

PASSED Manual Testing following the steps in the description.

Reproduced on:
Tomcat 7.0 + MySQL 5. 6.2.x Revision: 95520.

Fixed on:
Tomcat 7.0 + MySQL 5. 6.1.x Revision: 96736.
Tomcat 7.0 + MySQL 5. 6.2.x Revision: 96736.

Javascript error is no longer present.

[Edward Gonzales]

Hello everyone! We are in the process of removing component "Portlet" from LPS. Please make the necessary adjustments to affected filters. Thanks!