Cross site scripting vulnerability

[Holger Schimanski]

When Jira admin add a project role description with some HTML syntax like " onmouseover="alert('XSS'), then this is rendered on the project role tab without escaping and hence treated as HTML code by the browser.

This is a potential security issue and should be fixed by enabling HTML encoding of the rendering of the project role description.

‌

[Holger Schimanski]

Fixed by adding #enable_html_escaping() to the velocity template for the rendering of the project role tab page.