Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-9658

XSS in the user profile

    XMLWordPrintable

    Details

    • Development Priority:
      High
    • Difficulty:
      Hard
    • Documentation:
      N/A
    • Documentation in Release Notes:
      N/A
    • Similar issues:

      Description

      See XWIKI-8592. We reverted the fix because it was causing too many regressions. A fix for this issue should take into account the use cases described in the comments posted to XWIKI-8592. To summarise them:

      • custom property displayers should be applied in view mode (e.g. for List or Users and Email property types)
      • Database List property values should be displayed correctly in view mode
      • links in TextArea properties like comment and address should work

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              mleduc Manuel Leduc
              Reporter:
              mflorea Marius Dumitru Florea
              Votes:
              1 Vote for this issue
              Watchers:
              3 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:
                Date of First Response: