Details
Description
Steps to replicate:
- Add an attachment
- Rename the file to "<iframe onload=alert(1)>.txt"
- Copy its remove link and open the link in a new browser window
- Result: The JavaScript code is executed, rather than showing the "proceed w/ deletion" screen.
Everything works normally if you just click the delete button rather than copying the link into a new tab.
Attachments
Issue Links
- mentioned in
-
Wiki Page Loading...