Edgewall Software
Modify ↓

Ticket #817 (closed defect: fixed)

Opened 8 years ago

Last modified 6 years ago

User names associated with ticket attachments are not HTML-escaped

Reported by: cmlenz Owned by: jonas
Priority: normal Milestone: 0.8
Component: ticket system Version: devel
Severity: minor Keywords:
Cc:
Release Notes:
API Changes:

Description

As can be seen on ticket #791 (as of this writing), the name of the user that has added an attachment to the ticket is not escaped. In particular, this is a problem with session names including the email address, such as Tom example <tom@example.com>. Here the email address in interpreted as a tag by browsers.

Attachments

Change History

comment:1 Changed 8 years ago by cmlenz

  • Resolution set to fixed
  • Status changed from new to closed

That appears to have been fixed in [913].

View ↑

Add a comment

Modify Ticket

Change Properties
<Author field>
Action
as closed
The resolution will be deleted. Next status will be 'reopened'
to The owner will be changed from jonas. Next status will be 'closed'
Author


E-mail address and user name can be saved in the Preferences.

Attachments ↑
 
Note: See TracTickets for help on using tickets.