mahara-contributors team mailing list archive

[Mahara Bot <1720034@xxxxxxxxxxxxxxxxxx>]

Reviewed:  https://reviews.mahara.org/8221
Committed: https://git.mahara.org/mahara/mahara/commit/039bbd9b5c350e1a9f2b895aeefb661dace62021
Submitter: Robert Lyon (robertl@xxxxxxxxxxxxxxx)
Branch:    17.04_STABLE

commit 039bbd9b5c350e1a9f2b895aeefb661dace62021
Author: Robert Lyon <robertl@xxxxxxxxxxxxxxx>
Date:   Thu Sep 28 14:07:40 2017 +1300

Bug 1720034: Journal/Journal post title not being escaped in delete
button

behatnotneeded

Change-Id: I6f0c82a74e0d60614230aac1d4fc3884eae387a5
Signed-off-by: Robert Lyon <robertl@xxxxxxxxxxxxxxx>
(cherry picked from commit c367be4d30e4b0dd45cd76373b19c7393f7809ee)
(cherry picked from commit 465b7df21db3c4cb2780475d46ec77bcebda8831)

-- 
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
Matching subscriptions: Subscription for all Mahara Contributors -- please ask on #mahara-dev or mahara.org forum before editing or unsubscribing it!
https://bugs.launchpad.net/bugs/1720034

Title:
  journal titles not being escaped

Status in Mahara:
  Fix Released
Status in Mahara 15.04 series:
  Fix Committed
Status in Mahara 16.04 series:
  Fix Committed
Status in Mahara 16.10 series:
  Fix Committed
Status in Mahara 17.04 series:
  Fix Committed
Status in Mahara 17.10 series:
  Fix Released

Bug description:
  Steps to test:

  - create a journal
  - set title to: 
   <script>alert(1)</script> 
  - save
  alert is displayed

  - add an entry to the journal 
  - set title to: 
   <script>alert(1)</script> 
  alert is displayed

To manage notifications about this bug go to:
https://bugs.launchpad.net/mahara/+bug/1720034/+subscriptions