Details

    • Branch Version/s:
      6.1.x
    • Backported to Branch:
      Committed
    • Similar Issues:
      Show 2 results 

      Description

      Steps to reproduce:

      1. Create a microblog and add a comment to it with the following XSS content:

      <script>alert("this is an xss test");</script>

      2. Now when browsing any page we'll see the alert pop-up, since the dockbar contains the notification for the new comment with its content unescaped.

      The content of the notifications must be escaped to prevent XSS attacks.

        Activity

        Hide
        Ken Duenwald added a comment -

        PASSED Manual Testing following the steps in the description.

        Reproduced on:
        Tomcat 7.0.27 + MySQL 5. Portal 6.1.x EE GIT ID: 005c21c2dc71d92792e75a2c043c2ca95a8e44e4.
        Plugins 6.1.x EE GIT ID: 580842acf0afb4edfeb30f4f11a743f9b59b5aba.

        Pop-up window is visible in step 2.

        Fixed on:
        Tomcat 7.0.27 + MySQL 5. Portal 6.1.20 EE GA2.
        Plugins 6.1.x EE GIT ID: 59a7fc53c7f0845b539855fcb35aeb35f2cc2522.
        Tomcat 7.0.27 + MySQL 5. Portal 6.1.x EE GIT ID: 0c8d7ff1bd07d791d1e0713c77bc2bfc26868b37.
        Plugins 6.1.x EE GIT ID: 59a7fc53c7f0845b539855fcb35aeb35f2cc2522.

        Pop up window is no longer visible in step 2.

        Show
        Ken Duenwald added a comment - PASSED Manual Testing following the steps in the description. Reproduced on: Tomcat 7.0.27 + MySQL 5. Portal 6.1.x EE GIT ID: 005c21c2dc71d92792e75a2c043c2ca95a8e44e4. Plugins 6.1.x EE GIT ID: 580842acf0afb4edfeb30f4f11a743f9b59b5aba. Pop-up window is visible in step 2. Fixed on: Tomcat 7.0.27 + MySQL 5. Portal 6.1.20 EE GA2. Plugins 6.1.x EE GIT ID: 59a7fc53c7f0845b539855fcb35aeb35f2cc2522. Tomcat 7.0.27 + MySQL 5. Portal 6.1.x EE GIT ID: 0c8d7ff1bd07d791d1e0713c77bc2bfc26868b37. Plugins 6.1.x EE GIT ID: 59a7fc53c7f0845b539855fcb35aeb35f2cc2522. Pop up window is no longer visible in step 2.

          People

          • Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:
              Date of First Response:
              Days since last comment:
              2 years, 23 weeks, 2 days ago

              Development

                Structure Helper Panel