search

dennisreimann / masquerade

masquerade is the predecessor of masq: https://github.com/dennisreimann/masq - please consider using masq from now on, as it is the more modular approach.
MIT License
218 stars 46 forks source link

xss vulnerability #18

Closed saten closed 14 years ago

saten commented 14 years ago

the render_openid_error in server_controller.rb is vulnerable to (reflected) xss injection. this is easy fixable by escaping everything which get echoed to the user.

dennisreimann commented 14 years ago

Fixed XSS vulnerability. Closed by a3e83c7831a8d3ecf0e85acb016a2271f5f23dce