2013-09-26 01:11:59 +02:00
|
|
|
# 2.4.13
|
|
|
|
|
|
|
|
|
|
## Overview
|
|
|
|
|
|
|
|
|
|
### Security: XSS in form validation errors (SS-2013-008)
|
|
|
|
|
|
2015-12-01 18:58:31 +13:00
|
|
|
See [announcement](https://www.silverstripe.org/download/security-releases/ss-2013-008-xss-in-numericfield-validation/)
|
2013-09-26 01:11:59 +02:00
|
|
|
|
|
|
|
|
### Security: XSS in CMS "Pages" section (SS-2013-009)
|
|
|
|
|
|
2015-12-01 18:58:31 +13:00
|
|
|
See [announcement](https://www.silverstripe.org/download/security-releases/ss-2013-009-xss-in-cms-pages-section/)
|
2013-09-26 01:11:59 +02:00
|
|
|
|
|
|
|
|
### API: Form validation message no longer allow HTML
|
|
|
|
|
|
|
|
|
|
Due to cross-site scripting concerns when user data is used for form messages,
|
|
|
|
|
it is no longer possible to use HTML in `Form->sessionMessage()`, and consequently
|
|
|
|
|
in the `FormField->validate()` API.
|
