Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

处理后台各个输入框的 XSS 安全问题 #1557

Open
ruibaby opened this issue Dec 2, 2021 · 2 comments
Open

处理后台各个输入框的 XSS 安全问题 #1557

ruibaby opened this issue Dec 2, 2021 · 2 comments
Labels
kind/feature Categorizes issue or PR as related to a new feature. vulnerability Vulnerability
Milestone

Comments

@ruibaby
Copy link
Member

ruibaby commented Dec 2, 2021

What is version of Halo has the issue?

1.4.13

What database are you using?

H2

What is your deployment method?

Fat Jar

Your site address.

No response

What happened?

虽然目前后台仅仅只能由一个管理员来操作,但某些内容输入框能够插入 JavaScript 代码依旧是不妥的,比如文章标题、分类创建等。希望能够对这些地方做处理。

Relevant log output

No response

Additional information

No response

@ruibaby ruibaby added the kind/bug Categorizes issue or PR as related to a bug. label Dec 2, 2021
@ruibaby ruibaby added this to the 1.5.x milestone Dec 2, 2021
@ruibaby ruibaby added kind/feature Categorizes issue or PR as related to a new feature. vulnerability Vulnerability and removed kind/bug Categorizes issue or PR as related to a bug. labels Dec 6, 2021
@guqing guqing modified the milestones: 1.5.x, 2.0 Feb 18, 2022
@LawssssCat
Copy link

代码直接就在后台执行了,这个bug挺严重的。请问哪个版本修复了?

@ruibaby
Copy link
Member Author

ruibaby commented Apr 11, 2022

代码直接就在后台执行了,这个bug挺严重的。请问哪个版本修复了?

目前访客仅能在评论部分提交内容,这部分是做了处理的。后台目前属于单管理员,我们认为在当前这并不属于严重的问题。

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/feature Categorizes issue or PR as related to a new feature. vulnerability Vulnerability
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants