Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Stop allowing HTML in Event Sermon text #7068

Merged
merged 1 commit into from
Jun 12, 2024

Conversation

respencer
Copy link
Contributor

Description & Issue number it closes

Allowing HTML in Event Sermon text also allowed XSS. Removed allowing HTML in said field.

Resolves #6851

Screenshots (if appropriate)

None.

How to test the changes?

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update

How Has This Been Tested?

Checklist:

  • My code follows the style guidelines of this project
  • I have performed a self-review of my code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes
  • Any dependent changes have been merged and published in downstream modules

@respencer respencer marked this pull request as ready for review June 10, 2024 14:21
@respencer respencer requested a review from a team as a code owner June 10, 2024 14:21
@respencer respencer requested review from DawoudIO, grayeul, DAcodedBEAT and MrClever and removed request for a team June 10, 2024 14:21
src/EventEditor.php Outdated Show resolved Hide resolved
src/EventEditor.php Outdated Show resolved Hide resolved
src/EventEditor.php Show resolved Hide resolved
@DAcodedBEAT DAcodedBEAT merged commit 6be4531 into ChurchCRM:master Jun 12, 2024
3 checks passed
@respencer respencer deleted the 6851-xss-event-editor branch June 12, 2024 13:18
@DAcodedBEAT DAcodedBEAT added this to the 5.9.0 milestone Jun 12, 2024
@DAcodedBEAT DAcodedBEAT added Security php Pull requests that update Php code labels Jun 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
php Pull requests that update Php code Security
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Security Bug: SELF XSS - Event Editor
3 participants