where's the fix for this Atalssian? 

The text gadget can make JIRA vulnerable to XSS attacks because it allows arbitrary html, which is why it is disabled by default.A wiki rendering replacement could cater to the needs of an arbitrary html gadget without the danger. Custom html could still be added to the wiki gadget where required through the creation of macro plugins for JIRA's wiki renderer.

Yes it will be very useful.

I do not understand why Jira dashboard does not know this basic features.

If you see to any other dashboard applications they can in the basic settings to change these:

• text
• labels
• color
• titles
• size

The Jira does not know such a simple things. It can do only sizing and in very simple way. I think Dashboards in Jira are very sloppy! And it takes nearly 5 years without changing!!!

A new text gadget for jira server which does not cause any security problems would be extremely helpful and useful.

+1. keeping the text gadget to allow only plain text would be already better. removing such unsafe text widget entirely is even better than the current situation -> we are able to turn it on, but it is inherently not secure - no, thanks.

Thanks for the pointer to the add-on in Labs. Too bad it gets omitted when we use "View as wallboard" - so it is still not transferring onto our TV display.

Hi,

There is an unsupported add-on from Atlassian Labs that provides a rich text dashboard gadget for JIRA Cloud. You can find it by searching for "rich text gadget" in the Find New Add-ons page on your JIRA Cloud instance or getting it from the Atlassian Marketplace.

Dave Meyer

Senior Product Manager, JIRA

Any News on this?

I've evaluated the Introduction Gadget and it does not meet our needs. Please inform me when you resolve the security issues with your Text Gadget because we are more interested in it.

I was also looking to have this work in the cloud.

It would add a lot of value in providing the ability to add headings to more complex dashboards and link to external pages easily.

My understanding is that there were some security concerns regarding XSS with the use of this gadget. However, restricting its use entirely doesn't seem like the best solution to the problem. At the very least, it would be nice for administrators to be able to add HTML-only content.

To be able to create useful dashboards, we would need this feature again. Otherwise users just see a combination of controls, without any further explanation. So please enable this feature again! (Or replace it my another one that fulfills those requirements).