PMCORE-4269: Stored XSS flaw in PM 3.8.3

2024-01-18 19:08:33 +00:00
parent fa788911f4
commit bb56770a19
1 changed files with 3 additions and 2 deletions
--- a/workflow/engine/templates/cases/caseChangeLog.js
+++ b/workflow/engine/templates/cases/caseChangeLog.js
@@ -60,6 +60,7 @@ Ext.onReady(function () {
                            menuDisabled: true,
                            renderer: function (value, metaData, record, rowIndex, colIndex, store) {
                                return "<b>"+value+"</b>";
+
                            }
                        },
                        {
@@ -69,7 +70,7 @@ Ext.onReady(function () {
                            dataIndex: 'previousValue',
                            menuDisabled: true,
                            renderer: function (value, p, record) {
-                                return value;
+                                return Ext.util.Format.htmlEncode(value);
                            }
                        },
                        {
@@ -79,7 +80,7 @@ Ext.onReady(function () {
                            dataIndex: 'currentValue',
                            menuDisabled: true,
                            renderer: function (value, p, record) {
-                                return value;
+                                return Ext.util.Format.htmlEncode(value);
                            }
                        },
                        {