Skip to content
Snippets Groups Projects
  • JediKev's avatar
    c3ba5b78
    xss: Install Form · c3ba5b78
    JediKev authored
    This addresses an issue reported by Aishwarya Iyer where inserting `<img src
    =x onerror = prompt(1)` into any text field on the install form will execute
    in the browser after the system is installed and you log in. This is due to
    us not sanitizing the content before it’s saved in the database. This adds
    `Format::htmlchars()` to the installer to ensure the text field data is
    sanitized properly.
    c3ba5b78
    History
    xss: Install Form
    JediKev authored
    This addresses an issue reported by Aishwarya Iyer where inserting `<img src
    =x onerror = prompt(1)` into any text field on the install form will execute
    in the browser after the system is installed and you log in. This is due to
    us not sanitizing the content before it’s saved in the database. This adds
    `Format::htmlchars()` to the installer to ensure the text field data is
    sanitized properly.