XMLWordPrintable

    Details

      Description

      A user with username "><script>alert("foo")</script> that is linked to via [~username] markup results in script being executed.

      Curiously, viewing the space homepage of that user results in a blank page.

      This of course is prevented for public signup, but if the user gets created via other means, i.e. external user management, or via admin control panel then this is a valid point of attack

        Attachments

          Issue Links

            Activity

              People

              • Votes:
                0 Vote for this issue
                Watchers:
                0 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:
                  Last commented:
                  9 years, 41 weeks, 5 days ago