Feeling Lucky
PR-5.2-dev
[#44339] - Update template.js DOM Text Interpretd as html
- Closed
- 8 Nov 2024
- Medium
- Build: 5.2-dev
- # 44339
- Diff
- Shivam7-1:patch-2
User tests: Successful: Unsuccessful:
Summary of Changes
By using innerText, it will avoid the risk of HTML injection, as these properties automatically escape any HTML special characters in the provided text.
This helps make page more safer as compare to innerHTML and prevent cross-site scripting (XSS) vulnerabilities by treating the input as plain text rather than interpreted HTML.
Link to documentations
Please select:
-
Documentation link for docs.joomla.org:
-
No documentation changes for docs.joomla.org needed
-
Pull Request link for manual.joomla.org:
-
No documentation changes for manual.joomla.org needed
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | JavaScript Repository |
| Status | Pending | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2024-11-08 08:25:06 |
| Closed_By | ⇒ | SniperSister | |
| Labels |
Added:
PR-5.2-dev
|
||
The relevant strings are no user provided content, they are hardcoded - there is no vector.
If someone wants to test and fix this then please be aware that it's just a change for the sake of changing.