Unescaped data in log view.

symphonists / search_index

Search Index provides an easy way to implement high performance fulltext searching on your Symphony site

32 stars 21 forks source link

Unescaped data in log view. #15

Closed passbe closed 12 years ago

passbe commented 13 years ago

When entering JavaScript into a search field, the resulting search results page correctly shows the escaped version of the text (due to the XSS Filter Extension).

However when viewing the log of performed searches the JavaScript is successfully executed, opening a XSS vulnerability.