Fixed
Pinned fields
Click on the next to a field label to start pinning.
Details
Assignee
Justin ChoiJustin Choi(Deactivated)Reporter
Sophia.ZhangSophia.Zhang(Deactivated)Branch Version/s
6.1.xBackported to Branch
CommittedFix Priority
3Git Pull Request
Components
Affects versions
Priority
Medium
Details
Details
Assignee
Justin Choi
Justin Choi(Deactivated)Reporter
Sophia.Zhang
Sophia.Zhang(Deactivated)Branch Version/s
6.1.x
Backported to Branch
Committed
Fix Priority
3
Git Pull Request
Components
Affects versions
Priority
Zendesk Support
Zendesk Support
Zendesk Support
Created June 17, 2012 at 11:05 PM
Updated June 24, 2023 at 3:49 PM
Resolved August 6, 2012 at 11:39 PM
Steps to reproduce:
Case 1:
1. Add New Document Type.
2. Drag Main Metadata Fields, Text and Text Box, Save.
3. Add a new document using this New Document Type.
3. Fill out <script>alert("xss")</script> for Text and Text Box field. Save.
4. Try to click on the document.
Xss alert will display.
In this case, text and Text Box have xss problem when creating New Document Type and adding New Data Definition in Dynamic Data List portlet.
Case 2
1. Add New Document Type with name "<script>alert("xss")</script>".
2. Add document with this type.
Note: Only fill out description with "<script>alert("xss")</script>" won't occur xss alert
Xss alert will display when try to click on this document.
Case 3:
1. Add New Document Type with name "<script>alert("xss")</script>"
2. Add an Asset Publish portlet.
Xss alert will occur.
Case 4.
1. Add an Asset Publish portlet first.
2. Add New Document Type with name "<script>alert("xss")</script>"
3. Try to upload a document with this document type.
Xss alert will occur.
Console error:
05:57:24,407 ERROR [MinifierUtil:109] 1: 10: Unexpected end of file
05:57:24,408 ERROR [MinifierUtil:109] 1: 0: Compilation produced 1 syntax errors.
05:57:24,409 ERROR [MinifierUtil:75] JavaScript Minifier failed for
alert-xss-