U4-9134 XSS security issue in the grid

exposing xss clean method on templateutilities.
making the clean xss string extensions public instead of internal.
ensuring the included grid renderers clean for xss.
ensuring the included grid editors using html.raw with value directly, cleans for xss.
This commit is contained in:
Claus
2016-11-08 09:55:24 +01:00
parent a0c672eb91
commit 8bb069e996
12 changed files with 164 additions and 118 deletions

View File

@@ -184,7 +184,7 @@ namespace Umbraco.Core
/// <param name="input"></param>
/// <param name="ignoreFromClean"></param>
/// <returns></returns>
internal static string CleanForXss(this string input, params char[] ignoreFromClean)
public static string CleanForXss(this string input, params char[] ignoreFromClean)
{
//remove any html
input = input.StripHtml();