Questions tagged [xss]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
92 views

CE Image makes my logs sad by using xss_clean

Since updating to EE 3.4.0, I keep getting an annoying notification that there's new junk in the dev-logs. And there, I only find this ... which seems to be done by the almighty CE Image. Deprecated ...
0
votes
0answers
56 views

What are the implications of Disabling XSS clean?

We're having a few strange problems where by .doc and .pdf files are failing to upload via freeform forms, yet this seems an intermittent issue with tests using the same file. I've noticed this issue ...
1
vote
1answer
66 views

Security test fails on freemember:update_profile form

EDIT This question is related to compliance to a specific security test, the problem has nothing to do with Freemember extension. For the record : The solution found to pass the test was to simply ...
0
votes
1answer
39 views

Add tags to Safe HTML

When I select "Allow only safe HTML" for EE's discussion forum it correctly allows tags for links, images, bold etc but it doesn't seem to allow <ol> or <li>. Is there any way to add these ...
0
votes
1answer
70 views

XSS cleaning for discussion forum module

How do I clean a discussion forum post from XSS attacks in EE? A bit of background, I'm using the EE discussion module and I've dropped in ckeditor so the user can easily embed youtube/vimeo videos ...
2
votes
3answers
64 views

Can you add to the restricted tags filter for security in EE to secure the application further?

I have a client who got a security check done on their site (they are a security company) and they came back with this in relation to an expresso store checkout: Checkout functionality Although ...
2
votes
2answers
184 views

XSS vulnerability - malicious cookie value

One of the sites I'm working on was subject to a penetration test and this is one of the items of feedback: I understand the issue in theory however as I've never had to deal with this sort of thing ...
1
vote
0answers
124 views

Is there a built-in way to sanitize data with parse_variables?

I'm a developer on a huge site that does millions of dollars of transactions per day. Our client has recently engaged a White Hat scanning firm to scan the site, and we've been having some issues. ...
1
vote
1answer
47 views

Upgrade to EE 2.7.3 login to CP via link not working any longer

On 2.5.5 I had a link like this on the client's product pages: http://cl.ly/image/2c3G3m1X0a3D Very simple, if they are logged into the CP on another tab, they click the edit link and it opens this ...
1
vote
1answer
113 views

Allowing script/form tags in RTE (WysiHat)

I was wondering if there was any way of being able to edit the WysiHat settings to allow script/form tags to be entered into them. We have a client who has a third party widget which require JS, and a ...
1
vote
1answer
163 views

Is it possible to disable XSS filtering on Cartthrob?

I'm looking for some hidden configuration settings that will allow me to disable XSS filtering when using Cartthrob. The global EE config item is ignored. Is this possible?
3
votes
1answer
275 views

Having trouble uploading PDFs to a channel

This is an EE1 site. Whenever I try to upload a PDF I get an error message saying that there was a problem uploading this file. The permissions on the server are still set to 777 and the XSS filtering ...
2
votes
1answer
342 views

Refused to execute a JavaScript script. Source code of script found within request

In my control panel, I am getting a bunch of javascript errors, starting with: Refused to execute a JavaScript script. Source code of script found within request. I read something about XSS filters ...
17
votes
3answers
2k views

Are PDFs still an XSS problem with EE uploads?

I keep running into this and I'm hoping there is a suitable solution - PDF uploads by anyone other than a super admin run into the error "the file cannot be written to disk". This persists unless, as ...