When it's not suppossed to display html tags it's turned out that there is XSS. You may reproduce this issue when editing field without raw data attribute and passing <script>alert('XSS')</script>.
Right now server always responds with escaped values. It unescapes values only if raw is enabled.
When it's not suppossed to display html tags it's turned out that there is XSS. You may reproduce this issue when editing field without
raw
data attribute and passing<script>alert('XSS')</script>
.Right now server always responds with escaped values. It unescapes values only if
raw
is enabled.