mahara-contributors team mailing list archive

[Mahara Bot <1719480@xxxxxxxxxxxxxxxxxx>]

Reviewed:  https://reviews.mahara.org/8219
Committed: https://git.mahara.org/mahara/mahara/commit/63c9b7c7fabd591012dc125ded8d0b012fec064c
Submitter: Robert Lyon (robertl@xxxxxxxxxxxxxxx)
Branch:    15.04_STABLE

commit 63c9b7c7fabd591012dc125ded8d0b012fec064c
Author: Robert Lyon <robertl@xxxxxxxxxxxxxxx>
Date:   Tue Sep 26 12:08:05 2017 +1300

Bug 1719480: Escaping the output of the webservice testclient

Before displaying it to screen

Change-Id: I0bfc727ca6e0feee649392fcd85a89b16f55201f
Signed-off-by: Robert Lyon <robertl@xxxxxxxxxxxxxxx>
(cherry picked from commit 648b191ed8f93c5b4171837018eebc3db19974ad)

-- 
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
Matching subscriptions: Subscription for all Mahara Contributors -- please ask on #mahara-dev or mahara.org forum before editing or unsubscribing it!
https://bugs.launchpad.net/bugs/1719480

Title:
  Webservice test client / elasticsearch not escaping returned dumped
  values to screen

Status in Mahara:
  Fix Released
Status in Mahara 15.04 series:
  In Progress
Status in Mahara 16.04 series:
  In Progress
Status in Mahara 16.10 series:
  In Progress
Status in Mahara 17.04 series:
  In Progress
Status in Mahara 17.10 series:
  Fix Released

Bug description:
  Similar problem to Bug 1719472 
  where we have a user with display name set to '<script>alert(1)</script>'

  When fetching this user via webservices the test client displays the
  output to screen without escaping it

To manage notifications about this bug go to:
https://bugs.launchpad.net/mahara/+bug/1719480/+subscriptions