tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-22 14:05:37 +02:00
Code Issues Projects Releases Wiki Activity
2b7a2a289e
silverstripe-framework/docs/en/changelogs/rc/3.1.0-rc3.md
Ingo Schommer 2b7a2a289e API Escape form validation messages (SS-2013-008)
2013-09-24 21:41:21 +02:00

722 B
Raw Blame History

3.1.0-rc3

Overview

Security: XSS in CMS "Security" section (SS-2013-007)

See announcement

Security: XSS in form validation errors (SS-2013-008)

See announcement

Security: XSS in CMS "Pages" section (SS-2013-009)

See announcement

API: Form validation message no longer allow HTML

Due to cross-site scripting concerns when user data is used for form messages, it is no longer possible to use HTML in Form->sessionMessage(), and consequently in the FormField->validate() API.