Uploaded image for project: 'PUBLIC - Liferay Portal Community Edition'
  1. PUBLIC - Liferay Portal Community Edition
  2. LPS-23076

Archived Setups - title of archived setup is not properly escaped

    Details

      Description

      1. add asset publisher to a page
      2. go to Configuration -> Setup
      3. go to Archive/Restore Setup
      4. save your setup as <script>alert("www.eo.pl");</script
        Effect: almost immediately you will see javascript error because HTML in that name was not escaped. This is security bug.

        Attachments

          Activity

            People

            • Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:
                Days since last comment:
                7 years, 17 weeks, 3 days ago

                Packages

                Version Package
                6.1.0 CE RC1
                --Sprint 11/12
                6.2.0 CE M2