mbirth/LuckyCoinkydink
Archived
1
0
Fork 0
Code Issues Pull Requests Activity

Fix missing escaping (possible XSS) of category names in the Backend

Browse Source 
Entry Admin, which would allow editors that create a forged
category name to attack other editors in the backend (privileged
access to the backend required).
Thanks a lot to Edric Teo for reporting this issue.
This commit is contained in:
Garvin Hicking
2015-03-12 10:15:31 +01:00
parent d84cd93c57
commit bdd6c4fb17
2 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
docs/NEWS
View File

@ -39,6 +39,12 @@ Version 2.1 ()
Version 2.0.1 ()
------------------------------------------------------------------------
* Fix missing escaping (possible XSS) of category names in the Backend
Entry Admin, which would allow editors that create a forged
category name to attack other editors in the backend (privileged
access to the backend required).
Thanks a lot to Edric Teo for reporting this issue.
* Improved detection for possible upgrade/plugin/PHP errors. A
warning will be emitted on the dashboard, when the Serendipity
JavaScript-library could not be loaded.