search

2amigos / yii2-editable-widget

X-Editable Widget for Yii2
Other
58 stars 20 forks source link

The content of a textinput field is executable #40

Open albertborsos opened 2 years ago

albertborsos commented 2 years ago

This line is pretty dangerous. Try to update a value to phpinfo in a textinput editable field, and refresh the page.

https://github.com/2amigos/yii2-editable-widget/blob/8de9559b20ed6a4af8a6cdd47bfa32b4f20c7bab/src/Editable.php#L105