Skip to content
This repository has been archived by the owner on Dec 13, 2022. It is now read-only.

fix(sec): remove xss injection of service output in host form #7865

Merged
merged 2 commits into from
Sep 28, 2019

Conversation

kduret
Copy link
Contributor

@kduret kduret commented Sep 23, 2019

Description

Remove xss injection in host form when service's plugin output contains javascript

Fixes MON-4148

Type of change

  • Patch fixing an issue (non-breaking change)
  • New functionality (non-breaking change)
  • Breaking change (patch or feature) that might cause side effects breaking part of the Software
  • Updating documentation (missing information, typo...)

Target serie

  • 2.8.x
  • 18.10.x
  • 19.04.x
  • 19.10.x (master)

How this pull request can be tested ?

  • monitor services
  • run following query in centreon_storage table : update services set output="<script>alert('toto');</script>";
  • go to monitoring host form
  • check that alrt box is not displayed

@kduret kduret merged commit 500bd68 into master Sep 28, 2019
@kduret kduret deleted the MON-4148-fix-service-output-xss branch September 28, 2019 06:03
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants