Details

    Description

      In the file : /portal-web/docroot/html/common/themes/top_meta.jspf

      /portal-web/docroot/html/common/themes/top_meta.jspf
      <%
      String refreshRate = request.getParameter("refresh_rate");
      %>
      
      <c:if test='<%= (refreshRate != null) && (!refreshRate.equals("0")) %>'>
      	<meta content="<%= HtmlUtil.escape(refreshRate) %>;" http-equiv="Refresh" />
      </c:if>
      

      Steps to reproduce :
      1- load the page : http://portal_host/web/guest?refresh_rate=5000;%22/%3E%3C/head%3E%3Cscript%3Ealert%28%22TEST%22%29;%3C/script%3E
      2- Javscript alert should appear.

      Attachments

        Activity

          People

            mark.jin Mark Jin (Inactive)
            oliveti Olivier Spieser (Inactive)
            Kiyoshi Lee Kiyoshi Lee
            Votes:
            1 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:
              9 years, 30 weeks, 4 days ago

              Packages

                Version Package
                6.0.X EE
                --Sprint 12/11
                6.1.0 CE RC1