Per http://drupal.org/node/475848, the security team has cleared this issue to be fixed publicly.

The draggableviews_repaired_msg is not sanitized before being passed to drupal_set_message, allowing an XSS attack. See line 331 of draggableviews.module

Comments

sevi’s picture

sevi commented
Status: Active » Needs review

Committed to Drupal-6--3 branch: http://drupal.org/cvs?commit=297026
Does this fixes this issue?

I'll add a new release soon.

Greetings,
sevi

sevi’s picture

sevi commented
Status: Needs review » Fixed

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.