mahara-contributors team mailing list archive

[Mahara Bot <1719480@xxxxxxxxxxxxxxxxxx>]

Reviewed:  https://reviews.mahara.org/8245
Committed: https://git.mahara.org/mahara/mahara/commit/3a1166a789e7eae75923dad5fd12f35230f0196c
Submitter: Robert Lyon (robertl@xxxxxxxxxxxxxxx)
Branch:    16.04_STABLE

commit 3a1166a789e7eae75923dad5fd12f35230f0196c
Author: Robert Lyon <robertl@xxxxxxxxxxxxxxx>
Date:   Wed Sep 27 16:33:03 2017 +1300

Bug 1719480: Need to escape displayname in elasticsearch templates

Change-Id: I663f6ffde03b6b3504d49a767ac0ff55d0ab8437
Signed-off-by: Robert Lyon <robertl@xxxxxxxxxxxxxxx>
(cherry picked from commit 056d42fc014a846399af42be84f243b0f419c939)
(cherry picked from commit 5b0b1f07ac798b01a6da204523ac7fa73ebd9130)

-- 
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
Matching subscriptions: Subscription for all Mahara Contributors -- please ask on #mahara-dev or mahara.org forum before editing or unsubscribing it!
https://bugs.launchpad.net/bugs/1719480

Title:
  Webservice test client / elasticsearch not escaping returned dumped
  values to screen

Status in Mahara:
  Fix Released
Status in Mahara 15.04 series:
  Fix Committed
Status in Mahara 16.04 series:
  Fix Committed
Status in Mahara 16.10 series:
  Fix Committed
Status in Mahara 17.04 series:
  Fix Committed
Status in Mahara 17.10 series:
  Fix Released

Bug description:
  Similar problem to Bug 1719472 
  where we have a user with display name set to '<script>alert(1)</script>'

  When fetching this user via webservices the test client displays the
  output to screen without escaping it

To manage notifications about this bug go to:
https://bugs.launchpad.net/mahara/+bug/1719480/+subscriptions