spode

Activity

• 
  yann → spode

  This issue is because of an unsafe use of ForceIncomingString() in the addon. Each and every use of this function should be wrapped in htmlspecialchars() to avoid XSS attacks. Edit files the files default.php library/Function.TagThis.php and make change all instances of ForceIncomingString([...]) to htmlspecialchars(ForceIncomingString([...])) and the code should be safe.

  December 2009
• 
  yann → spode

  Could you check issue #19 at http://code.google.com/p/lussumo-vanilla/issues/detail?id=19 Thanks.

  December 2009