mahara-contributors team mailing list archive

[Robert Lyon <robertl@xxxxxxxxxxxxxxx>]

** Changed in: mahara/16.04
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
Matching subscriptions: Subscription for all Mahara Contributors -- please ask on #mahara-dev or mahara.org forum before editing or unsubscribing it!
https://bugs.launchpad.net/bugs/1720034

Title:
  journal titles not being escaped

Status in Mahara:
  Fix Released
Status in Mahara 15.04 series:
  Fix Released
Status in Mahara 16.04 series:
  Fix Released
Status in Mahara 16.10 series:
  Fix Committed
Status in Mahara 17.04 series:
  Fix Committed
Status in Mahara 17.10 series:
  Fix Released

Bug description:
  Steps to test:

  - create a journal
  - set title to: 
   <script>alert(1)</script> 
  - save
  alert is displayed

  - add an entry to the journal 
  - set title to: 
   <script>alert(1)</script> 
  alert is displayed

To manage notifications about this bug go to:
https://bugs.launchpad.net/mahara/+bug/1720034/+subscriptions