XSS Vulnerability after Editing Tags

[Daniel Zoller]

After successfully editing tags (e.g. adding <script>alert("hallo")</script> as tag) using the modal fast editing dialog, a "hallo" message pops up. Please fix.

[Former user]

works here: 2e0d3d5

[Daniel Zoller]

Does not work

Tested using branch 2470

[Former user]

I double-checked this. On two different browsers I don't get alerts. hg status is clear and there are no outgoing changesets in eclipse. I definetely changed the right file.

However I don't get alerts on Biblicious either. So if my changes are not yet on biblicious there could still be something wrong with my setup.

[Daniel Zoller]

the alert view pops up after clicking on save not when opening the dialog

[Jennifer Häfner]

I changed the signs "<" and ">" to "<" and ">", later they get changed back. This way no alerts appear.

[Daniel Zoller]

I would suggest to use jqueries .text() method which escapes the text by default. No need to use the string replace method.

[Daniel Zoller]

refixed #2495

→ <<cset 8abb8f5fce53>>