Details

    • Branch Version/s:
      6.1.x
    • Backported to Branch:
      Committed
    • Fix Priority:
      3

      Description

      1) Login as 'test@liferay.com' / 'test'.
      2) Navigate to 'My Community Public Page'.
      3) Add a Page.
      4) Add the 'Activities Portlet' and the 'Blogs Portlet'.
      5) Add a blog entry with the following titles:

      <script>alert(document.domain)</script>
      <script>alert(document.domain)
      <script>alert(document.domain)</script>
      <script>alert(document.domain)

        • Notice if you view these entries in the Activities portlet the HTML will be escaped **
        • the entries will be displayed like the following: **

      <script>alert(document.domain)</script>
      <script>alert(document.domain)

      alert(document.domain)

      I've attached a picture of what they will look will be displayed.

        Attachments

          Issue Links

            Activity

              People

              • Votes:
                0 Vote for this issue
                Watchers:
                3 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:
                  Days since last comment:
                  5 years, 21 weeks, 2 days ago