[#34514] - [4.0] Allow form elements in a subform template (sanitisation)
- Fixed in Code Base
- 15 Jun 2021
- Medium
- Build: 4.0-dev
- # 34514
- Diff
- dgrammatiko:patch-1
User tests: Successful: Unsuccessful:
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | JavaScript Repository NPM Change |
| Labels |
Added:
NPM Resource Changed
?
|
||
and fields with onclick attributes
This is exactly what's not allowed and what the sanitizer is supposed to clean
then subfrom will be broken for these fields,
there may be fields that use it
then subfrom will be broken for these fields, there may be fields that use it
Hard call (thankfully not my call). Allowing inline on-events is XSS prone. Disallowing on-events is stricter but probably all elements will be required to be defined custom-elements (own constructor etc). I'm ok reverting this. @wilsonge your call...
I understood the intention, and it good one.
but it pretty hard.
I understood the intention, and it good one.
but it pretty hard.
Till there's a viable solution for sanitization of the subform templates the changes have been reverted
I have tested this item
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/34514.
I have tested this item
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/34514.
| Status | Pending | ⇒ | Ready to Commit |
RTC
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/34514.
| Status | Ready to Commit | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2021-06-15 07:02:13 |
| Closed_By | ⇒ | richard67 | |
| Labels |
Added:
?
|
||
Thanks!
hm, do we really need cleaning for subform "template"?
it can be pretty complex for a forms, there may be fields with custom element, and fields with onclick attributes