Details

      Description

      In the file : /portal-web/docroot/html/common/themes/top_meta.jspf

      /portal-web/docroot/html/common/themes/top_meta.jspf
      <%
      String refreshRate = request.getParameter("refresh_rate");
      %>
      
      <c:if test='<%= (refreshRate != null) && (!refreshRate.equals("0")) %>'>
      	<meta content="<%= HtmlUtil.escape(refreshRate) %>;" http-equiv="Refresh" />
      </c:if>
      

      Steps to reproduce :
      1- load the page : http://portal_host/web/guest?refresh_rate=5000;%22/%3E%3C/head%3E%3Cscript%3Ealert%28%22TEST%22%29;%3C/script%3E
      2- Javscript alert should appear.

        Attachments

          Activity

            People

            Assignee:
            mark.jin Mark Jin (Inactive)
            Reporter:
            oliveti Olivier Spieser (Inactive)
            Participants of an Issue:
            Recent user:
            Esther Sanz
            Votes:
            1 Vote for this issue
            Watchers:
            3 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved:
              Days since last comment:
              8 years, 37 weeks, 6 days ago

                Packages

                Version Package
                6.0.X EE
                --Sprint 12/11
                6.1.0 CE RC1