PUBLIC - Liferay Portal Community Edition

An "Open Script Tag" <script> in the title of a "Blogs Entry" throws Exceptions when viewed

Details

  • Branch Version/s:
    6.0.x
  • Backported to Branch:
    Committed
  • Similar Issues:
    Show 3 results 

Description

  1. Add the Blogs Portlet.
  2. Add the Blogs Aggregator Portlet to another page.
  3. Add a Blogs Entry with the title "<script>alert(hello)"

    For 6.1.x:

  • Viewing the Blogs Portlet will throw the attached exception.
  • The Blogs Aggregator Portlet will be displayed like the attached screenshot.
  • Viewing the Blogs Aggregator Portlet will throw the attached exception.

    For 6.0.x:

  • Viewing the Blogs Portlet will NOT throw the attached exception.
  • The Blogs Aggregator Portlet will be displayed like the attached screenshot.
  • Viewing the Blogs Aggregator Portlet will throw the attached exception.

Activity

Ascending order - Click to sort in descending order
Hide
Permalink
Ryan Wan added a comment -

PASSED Manual Testing following steps in description.

Reproduced on:
Tomcat 7.0.21 + MySQL 5.1.58. 6.1.x Revision 90970.

Fixed on:
Tomcat 7.0.21 + MySQL 5.1.58. 6.1.x Revision 91295.

Show
Ryan Wan added a comment - PASSED Manual Testing following steps in description. Reproduced on: Tomcat 7.0.21 + MySQL 5.1.58. 6.1.x Revision 90970. Fixed on: Tomcat 7.0.21 + MySQL 5.1.58. 6.1.x Revision 91295.
Hide
Permalink
Vicki Tsang added a comment -

This is being bulk closed in preparation for the new workflow.

Show
Vicki Tsang added a comment - This is being bulk closed in preparation for the new workflow.
Hide
Permalink
Pani Gui added a comment -

PASSED Manual Testing following steps in description.

Fixed on:
Tomcat 6.0.33 + MySQL 5. 6.0.x Revision: 94251.

There isn't exception when viewing the blog entry and blog entry message displays on Blogs Aggregator portlet.

Show
Pani Gui added a comment - PASSED Manual Testing following steps in description. Fixed on: Tomcat 6.0.33 + MySQL 5. 6.0.x Revision: 94251. There isn't exception when viewing the blog entry and blog entry message displays on Blogs Aggregator portlet.

People

Vote (0)
Watch (0)

Dates

  • Created:
    Updated:
    Resolved:
    Days since last comment:
    1 year, 25 weeks, 1 day ago