XSS can be exploited, but only from trusted users ("administer site configuration" permission).

CommentFileSizeAuthor
#1 token-1894890-custom_date_format_xss.patch705 bytesgrisendo
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

grisendo’s picture

grisendo CreditAttribution: grisendo commented
FileSize
token-1894890-custom_date_format_xss.patch705 bytes

I attach a patch

grisendo’s picture

grisendo CreditAttribution: grisendo commented
Status: Active » Needs review
Dave Reid’s picture

Dave Reid
he/him
Primary language English
Location Nebraska USA
CreditAttribution: Dave Reid commented
Status: Needs review » Fixed

Thanks, committed #1 to Git. http://drupalcode.org/project/token.git/commit/75a5414

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.