See linked issues in #1811684: XSS: Bartik's node.tpl.php prone to XSS (prints $title) for a convenient summary of context.

I'm not reporting this as a security issue, as I'm sure no-one will be using the D8 version yet.

The whitejazz theme has not been updated to use $node->label to print the sanitized title. Patch on the way ...

CommentFileSizeAuthor
#2 1815314-whitejazz-label-node-tpl.1.patch867 bytesalan evans
#1 1815314-whitejazz-label-node-tpl.patch787 bytesalan evans

Comments

alan evans’s picture

alan evans commented
StatusFileSize
new 1815314-whitejazz-label-node-tpl.patch787 bytes
alan evans’s picture

alan evans commented
StatusFileSize
new 1815314-whitejazz-label-node-tpl.1.patch867 bytes

Need to line up the empty check also ...

kisugiai’s picture

kisugiai commented

hm is this only in the D8 version or in D7 to?

kisugiai’s picture

kisugiai commented
Status: Needs review » Closed (fixed)