-
Bug
-
Resolution: Fixed
-
Medium
-
3.0
-
None
A user with username "><script>alert("foo")</script> that is linked to via [~username] markup results in script being executed.
Curiously, viewing the space homepage of that user results in a blank page.
This of course is prevented for public signup, but if the user gets created via other means, i.e. external user management, or via admin control panel then this is a valid point of attack
- is caused by
-
-
- Closed
-
- relates to
-
-
- Closed
-
