ofbiz-notifications mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Jacques Le Roux (JIRA)" <j...@apache.org>
Subject [jira] [Assigned] (OFBIZ-10054) Product content management screen doesn't validate trusted users' input
Date Mon, 06 May 2019 13:00:01 GMT

     [ https://issues.apache.org/jira/browse/OFBIZ-10054?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]

Jacques Le Roux reassigned OFBIZ-10054:
---------------------------------------

    Assignee: Jacques Le Roux

> Product content management screen doesn't validate trusted users' input
> -----------------------------------------------------------------------
>
>                 Key: OFBIZ-10054
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-10054
>             Project: OFBiz
>          Issue Type: Improvement
>          Components: product
>    Affects Versions: Trunk, Release Branch 16.11
>            Reporter: Jacopo Cappellato
>            Assignee: Jacques Le Roux
>            Priority: Major
>
> Steps to recreate:
> 1) go to (authenticate with admin/ofbiz):
> https://localhost:8443/catalog/control/EditProductContent?productId=WG-1111
> 2) set the content of the field labeled "Large Image" to:
> non_existent.foo&quot; onerror=&quot;alert(&apos;Hi!&apos;);
> 3) visit the url:
> https://localhost:8443/ecommerce/control/product?product_id=WG-1111
> A popup message will appear with the "Hi!".
> Thanks to Loris Nardo for the report.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

Mime
View raw message