[XWIKI-9658] XSS in the user profile - XWiki.org JIRA

XML

Word

Printable

Details

Type: Bug
Status: Closed
Priority: Major
Resolution: Solved By
Affects Version/s: 5.3-milestone-1, 5.2.1
Fix Version/s: 12.8, 12.6.3, 11.10.11
Component/s: User - User Profile
Labels:

Development Priority:
High
Difficulty:
Hard
Documentation:
N/A
Documentation in Release Notes:
N/A
Similar issues:

Description

See XWIKI-8592. We reverted the fix because it was causing too many regressions. A fix for this issue should take into account the use cases described in the comments posted to XWIKI-8592. To summarise them:

custom property displayers should be applied in view mode (e.g. for List or Users and Email property types)
Database List property values should be displayed correctly in view mode
links in TextArea properties like comment and address should work

Attachments

Issue Links

depends on

XWIKI-17374 XSS Cross Site Scripting

Closed

is related to

XWIKI-9652 Obfuscate e-mail address does not work anymore

Closed

XWIKI-9653 User Picker doesn't display a correct value on the User Profile page in view mode

Closed

XWIKI-9655 Links don't work any more in the comment and address user profile fields

Closed

Activity

People

Assignee:: Manuel Leduc

Reporter:: Marius Dumitru Florea

Votes:: 1 Vote for this issue

Watchers:: 3 Start watching this issue

Dates

Created:: 12/Nov/13 08:47

Updated:: 20/Apr/21 09:35

Resolved:: 24/Sep/20 14:40

Date of First Response:: 24/Sep/20 2:40 PM