ajung/plone.app.discussion
ajung/plone.app.discussion
0
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #98 from plone/maurits-xss-master

Browse Source 
Fixed possible cross site scripting attack on moderate comments page [master]
This commit is contained in:
Maurits van Rees 2016-06-06 10:10:57 +02:00
commit 43ea783824
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
CHANGES.rst
View File

@ -14,7 +14,7 @@ New features:
Bug fixes: Bug fixes:
- *add item here* - Fixed possible cross site scripting (XSS) attack on moderate comments page. [maurits]

2
plone/app/discussion/browser/moderation.pt
View File

@ -110,7 +110,7 @@
tal:content="item/in_response_to" /> tal:content="item/in_response_to" />
</td> </td>
<td> <td>
<span tal:replace="structure item/Description" /> <span tal:replace="item/Description" />
<a href="" <a href=""
tal:attributes="href string:${item/getURL}/getText" tal:attributes="href string:${item/getURL}/getText"
tal:condition="python:item.Description.endswith('[...]')" tal:condition="python:item.Description.endswith('[...]')"