Uploaded image for project: 'PUBLIC - Liferay Portal Community Edition'
  1. PUBLIC - Liferay Portal Community Edition
  2. LPS-23075

Related articles - HTML in Web Content title is not properly escaped

    Details

      Description

      1. add web content with title: <script>alert("www.eo.pl");</script>
      2. add another web content, go to Related Asset section and try to search for other web content
        Effect: you will see javascript alert because HTML code in web content title was not escaped. This is security bug

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              michael.saechang Michael Saechang
              Reporter:
              szymon.golebiewski Szymon Golebiewski (Inactive)
              Participants of an Issue:
              Recent user:
              Marta Elicegui
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:
                Days since last comment:
                8 years, 41 weeks, 2 days ago

                  Packages

                  Version Package
                  --Sprint 11/12
                  6.2.0 CE M2