Lasso Soft Inc. > Home

RhinoTrac

LassoSoft Ticket Tracking System

NOTE: If you are using Lasso Server 9.3 please Log your ticket directly via the LUX admin as this will give us more information about your issue.

Lasso 9 Issues



Ticket #8001: RhinoTrac does not encode html code properly

Reported by:
Jolle Carlestam
Date:
14 Jan, 2016
Priority:
major
Component:
Lasso 9
Version:
Keywords:
Platform:
Issue Report from Jolle Carlestam (jolle@carlestam.com)
Company: Kulturfaktorn

Component: Lasso 9 Server
Version: 9.3.1
Source IP: 81.234.192.155

Detail
======
Adding html as part of the detailed description to a Rhinotrac ticket is not properly encoded when viewed in a browser.
This is a security issue as demonstrated by Bil Corry at the latest LDC.

For example:
<script>
alert("Ooops")
</script>
Please log in to your LassoSoft account to comment

LassoSoft Inc. > Home

 

 

©LassoSoft Inc 2015 | Web Development by Treefrog Inc | PrivacyLegal terms and Shipping | Contact LassoSoft