Reviewed: https://reviews.mahara.org/8245 Committed: https://git.mahara.org/mahara/mahara/commit/3a1166a789e7eae75923dad5fd12f35230f0196c Submitter: Robert Lyon (robe...@catalyst.net.nz) Branch: 16.04_STABLE
commit 3a1166a789e7eae75923dad5fd12f35230f0196c Author: Robert Lyon <robe...@catalyst.net.nz> Date: Wed Sep 27 16:33:03 2017 +1300 Bug 1719480: Need to escape displayname in elasticsearch templates Change-Id: I663f6ffde03b6b3504d49a767ac0ff55d0ab8437 Signed-off-by: Robert Lyon <robe...@catalyst.net.nz> (cherry picked from commit 056d42fc014a846399af42be84f243b0f419c939) (cherry picked from commit 5b0b1f07ac798b01a6da204523ac7fa73ebd9130) -- You received this bug notification because you are a member of Mahara Contributors, which is subscribed to Mahara. Matching subscriptions: Subscription for all Mahara Contributors -- please ask on #mahara-dev or mahara.org forum before editing or unsubscribing it! https://bugs.launchpad.net/bugs/1719480 Title: Webservice test client / elasticsearch not escaping returned dumped values to screen Status in Mahara: Fix Released Status in Mahara 15.04 series: Fix Committed Status in Mahara 16.04 series: Fix Committed Status in Mahara 16.10 series: Fix Committed Status in Mahara 17.04 series: Fix Committed Status in Mahara 17.10 series: Fix Released Bug description: Similar problem to Bug 1719472 where we have a user with display name set to '<script>alert(1)</script>' When fetching this user via webservices the test client displays the output to screen without escaping it To manage notifications about this bug go to: https://bugs.launchpad.net/mahara/+bug/1719480/+subscriptions _______________________________________________ Mailing list: https://launchpad.net/~mahara-contributors Post to : mahara-contributors@lists.launchpad.net Unsubscribe : https://launchpad.net/~mahara-contributors More help : https://help.launchpad.net/ListHelp
