U4-9134 XSS security issue in the grid
exposing xss clean method on templateutilities. making the clean xss string extensions public instead of internal. ensuring the included grid renderers clean for xss. ensuring the included grid editors using html.raw with value directly, cleans for xss.
This commit is contained in:
@@ -184,7 +184,7 @@ namespace Umbraco.Core
|
||||
/// <param name="input"></param>
|
||||
/// <param name="ignoreFromClean"></param>
|
||||
/// <returns></returns>
|
||||
internal static string CleanForXss(this string input, params char[] ignoreFromClean)
|
||||
public static string CleanForXss(this string input, params char[] ignoreFromClean)
|
||||
{
|
||||
//remove any html
|
||||
input = input.StripHtml();
|
||||
|
||||
Reference in New Issue
Block a user