Uploaded image for project: 'PUBLIC - Liferay Portal Community Edition'
  1. PUBLIC - Liferay Portal Community Edition
  2. LPS-23075

Related articles - HTML in Web Content title is not properly escaped

    Details

      Description

      1. add web content with title: <script>alert("www.eo.pl");</script>
      2. add another web content, go to Related Asset section and try to search for other web content
        Effect: you will see javascript alert because HTML code in web content title was not escaped. This is security bug

        Attachments

          Issue Links

            Activity

              People

              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:
                  Days since last comment:
                  8 years, 29 weeks, 4 days ago

                  Packages

                  Version Package
                  --Sprint 11/12
                  6.2.0 CE M2