cross
New Foswiki release 2.1.6 is available with important security fixes.
Sourceforge foswiki email lists being discontinued. Subscribe to the new Foswiki announce and discuss lists at MailingLists
You are here: Foswiki>Tasks Web>Item13832 (16 Nov 2015, GeorgeClark)Edit Attach

Item13832: Don't allow non-alphas as the effect name in jqLoader.

pencil
Priority: Security
Current State: Closed
Released In: 2.0.3
Target Release: patch
Applies To: Engine
Component:
Branches: master
Reported By: JozefMojzis
Waiting For:
Last Change By: GeorgeClark
http://localhost:5000/System/JQueryLoader?effect='%2b(function(){alert(1)}())%2b'

-- JozefMojzis - 21 Oct 2015

 

ItemTemplate edit

Summary Don't allow non-alphas as the effect name in jqLoader.
ReportedBy JozefMojzis
Codebase trunk
SVN Range
AppliesTo Engine
Component
Priority Security
CurrentState Closed
WaitingFor
Checkins distro:b81db1b39bdb distro:acf811b06aef
TargetRelease patch
ReleasedIn 2.0.3
CheckinsOnBranches master
trunkCheckins
masterCheckins distro:b81db1b39bdb distro:acf811b06aef
ItemBranchCheckins
Release01x01Checkins
Topic revision: r5 - 16 Nov 2015, GeorgeClark - This page was cached on 21 Mar 2018 - 06:55.

The copyright of the content on this website is held by the contributing authors, except where stated elsewhere. See Copyright Statement. Creative Commons License