This is a public bug for core and many modules - role names shoudl be escpaed before display since someone with 'administer roles' could add a role with XSS in the name. Obviously to be able to add roles you are already a super admin, but might as well keep it tight.

CommentFileSizeAuthor
#1 security-role-names-632342-1.patch479 bytespwolanin

Comments

pwolanin’s picture

pwolanin commented
Status: Active » Needs review
StatusFileSize
new security-role-names-632342-1.patch479 bytes
sun’s picture

sun
Primary language German
Location Karlsruhe
commented
Status: Needs review » Fixed

Thanks for reporting, reviewing, and testing! Committed to all branches.

A new development snapshot will be available within the next 12 hours. This improvement will be available in the next official release.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.