PWC identified an issue with the subsites module that would allow someone with authenticated access to attack other CMS users, such as "stealing the session ID and hijacking an authenticated user's session".
I can't imagine a case where HTML would ever be allowed in the subdomain of a website, so it's a good practice to strip it out anyway.
Steps to reproduce the original issue:
1. Enter a subsite name and mark as the default site.
2. Add a new domain named <script>alert(2)</script> and mark it as primary
3. Switch to the new subsite.
4. Make a new Page. This will execute a javascript alert containing "2".
MINOR update documentation for onBeforeWrite()
MINOR add @property attributes into docblock
Fixed a few missed strict errors
Applied patch from kmayo to fix issues with SubsiteAdminTest.php
Fixed issue causing the url segments of subsites created from a template to add -2 to the end
Fixed undefined method TotalItems() on datalist for the SubsiteTest
Fixed failure on SubsiteTest because DataObject::get_one() now returns boolean false instead of null when no result is found
Fixed failure on SubsitesVirtualPageTest caused by Versioned::get_one_by_stage() returning null instead of false
Fixed failure caused by the contact-us page existing on subsite 2
Merged another patch from kmayo
Force main site to be on, for some reason it gets hidden in some cases i.e. refreshing the cms while editing a page
Replaced deprecated DataObjectDecorator with DataExtension
Fixed hard crashes in the cms
Updated to support new LeftAndMain template structure
Made the subsites model admin functional
Moved the LeftAndMain_Menu template up a directory so it overrides the core
Fixed some errors caused by changes to the framework
Re-organized the code folder
Fixed permission issue causing to default to first subsite regardless if it is the default or not
Fixed crashes on the subsite virtual page when creating/editing
Removed toDropdownMap() calls replacing with map()
Fixed the URLSegment field on subsites
Fixed error when detecting subsite for a domain
Improved styles on the subsite dropdown
Updated LeftAndMain_Subsites.js to work with jQuery entwine
Started porting the SubsitesTreeDropdownField.js to use jQuery entwine and work with the new TreeDropdownField.js
Fixed issue causing crash when viewing a page who is linked to by a subsite virtual page
Removed unused methods on SubsitesTreeDropdownField.js
Re-added classes that were moved
Fixed hard crash after saving caused by the many_many definition on SiteTreeSubsites
Replaced deprecated DataObjectSet creation with ArrayList
Compatibility fixes with SS 3.0 beta 2
Fixed crash in cms caused by no parameter being passed to the SubsiteReportWrapper constructor
Proper fix for report wrapper
Removed table list field in favor of a basic grid field
Fixed updateCMSFields() for file subsites
Migrated translations to yml
Fixed issue causing the current page to not get cleared when changing subsites in the cms
Fixed virtual page icon
Fixed language files issue
