Project

General

Profile

Actions
Copy link

Bug #71698

closed

Link fields accept inline javascript code

Added by Oliver Hader over 8 years ago. Updated over 5 years ago.

Status:
Closed
Priority:
Should have
Assignee:
Oliver Hader
Category:
-
Target version:
-
Start date:
2015-11-19
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
6.2
PHP Version:
5.5
Tags:
Complexity:
Is Regression:
No
Sprint Focus:

Description

javascript:alert(1) can be submitted for every link field and will be rendered in the frontend passed through typolink. To circumvent that, the URI scheme and prefix "javascript:" will be disallowed per default. The extension "javascript_handler" allows however to bring back that insecure behavior since some installations might rely on it.

Files

javascript_handler_1.0.0.zip (2.27 KB) javascript_handler_1.0.0.zip Nicole Cordes, 2015-12-15 12:09
Actions
Copy link

Also available in: Atom PDF