Uploaded image for project: 'PUBLIC - Liferay Portal Community Edition'
  1. PUBLIC - Liferay Portal Community Edition
  2. LPS-89143

XSS when select web content in Web Content Display

Details

    Description

      Steps to reproduce:

      1. Create a web content named "<script>alert(123);</script>"
      2. Add a Web Content Display portlet to the page
      3. Click the link "Select Web Content to make it visible" in Web Content Display portlet
      4. Click "Select" button in Web Content Display Configuration
      5. Close the alert and save the configuration

      Expected Result:
      No popup displays.

      Actual Result:
      A popup displays at step 4 and 5.

      Attachments

        Issue Links

          Activity

            People

              lu.liu Lu Liu
              lu.liu Lu Liu
              Kiyoshi Lee Kiyoshi Lee
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:
                3 years, 37 weeks ago

                Packages

                  Version Package
                  7.1.10 DXP FP7
                  7.1.10.2 SP2
                  7.1.3 CE GA4
                  7.1.X
                  Master