mirror of
https://github.com/silverstripe/silverstripe-framework
synced 2024-10-22 14:05:37 +02:00
ad1b00ec7d
Silverstripe Forms allow malicious HTML or JavaScript to be inserted through non-scalar FormField attributes, which allows performing XSS (Cross-Site Scripting) on some forms built with user input (Request data). This can lead to phishing attempts to obtain a user's credentials or other sensitive user input. There is no known attack vector for extracting user-session information or credentials automatically, it required a user to fall for the phishing attempt. XSS can also be used to modify the presentation of content in malicious ways. |
||
|---|---|---|
| .. | ||
| 00_Model | ||
| 01_Templates | ||
| 02_Controllers | ||
| 03_Forms | ||
| 04_Configuration | ||
| 05_Extending | ||
| 06_Testing | ||
| 07_Debugging | ||
| 08_Performance | ||
| 09_Security | ||
| 10_Email | ||
| 11_Integration | ||
| 12_Search | ||
| 13_i18n | ||
| 14_Files | ||
| 15_Customising_the_Admin_Interface | ||
| 16_Execution_Pipeline | ||
| 17_CLI | ||
| 18_Cookies_And_Sessions | ||
| index.md | ||