Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-9658

XSS in the user profile

    XMLWordPrintable

Details

    • High
    • Hard
    • N/A
    • N/A

    Description

      See XWIKI-8592. We reverted the fix because it was causing too many regressions. A fix for this issue should take into account the use cases described in the comments posted to XWIKI-8592. To summarise them:

      • custom property displayers should be applied in view mode (e.g. for List or Users and Email property types)
      • Database List property values should be displayed correctly in view mode
      • links in TextArea properties like comment and address should work

      Attachments

        Issue Links

          depends on

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-17374 XSS Cross Site Scripting

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed
          is related to

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-9652 Obfuscate e-mail address does not work anymore

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-9653 User Picker doesn't display a correct value on the User Profile page in view mode

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-9655 Links don't work any more in the comment and address user profile fields

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-8592 XSS in the user profile

          • Major - Major loss of function.
          • Closed

          Activity

            People

              mleduc Manuel Leduc
              mflorea Marius Dumitru Florea
              Votes:
              1 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: