The mask field is not filtered. When adding a javascript it will be executed on page admin/user/rules.
I assume it's not a security issue because it's inside admin area.

CommentFileSizeAuthor
#1 user.admin_.inc_.patch824 bytessebdah

Comments

sebdah’s picture

sebdah commented
Version: 6.4 » 6.6
Status: Active » Needs review
StatusFileSize
new user.admin_.inc_.patch824 bytes

This exists in Drupal 6.6 as well. The patch need to be reviewed. I don't really know how the filtering should be done here, so I made a sample :/.

chx’s picture

chx commented

As ingo86 says, it could lead to a priviledge escalation.... however if you can get to this page then you already have every priviledge you wanted. You can easily give yourself enough access to run PHP code and then do whatever you wanted. I do not see the need to fix this.

dpearcefl’s picture

dpearcefl commented

Is this still an issue using current Drupal 6?

Status: Needs review » Needs work

The last submitted patch, user.admin_.inc_.patch, failed testing.

Status: Needs work » Closed (outdated)

Automatically closed because Drupal 6 is no longer supported. If the issue verifiably applies to later versions, please reopen with details and update the version.