[Dspace-devel] [DuraSpace JIRA] (DS-1702) XSS injection possible on collection home page for JSPUI

[Jean-P Xiao Zhao (DuraSpace JIRA)]

Jean-P Xiao Zhao created DS-1702 XSS injection possible on collection home page for JSPUI Issue Type: Bug Affects Versions: 3.2 Assignee: Unassigned Components: JSPUI Created: 15/Oct/13 5:31 PM Description: On the collection home page in JSPUI, there is a list of recent submissions that lists the titles of few items in the collection. The title strings do not pass Java's addEntities method and embeded _javascript_/css will be evaluated by the browser. To fix, add "Utils.addEntities" to "dcv[0].value" in "collection-home.jsp" Environment: N/A Project: DSpace Labels: JSPUI Priority: Major Reporter: Jean-P Xiao Zhao Original Estimate: 1 day Remaining Estimate: 1 day

This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira

------------------------------------------------------------------------------
October Webinars: Code for Performance
Free Intel webinars can help you accelerate application performance.
Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
the latest Intel processors and coprocessors. See abstracts and register >
http://pubads.g.doubleclick.net/gampad/clk?id=60135031&iu=/4140/ostg.clktrk
_______________________________________________
Dspace-devel mailing list
Dspace-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspace-devel