FLUID-569: Security: HTML should be filtered in OSDPL design pattern content

Metadata

Source
FLUID-569
Type
Sub-task
Priority
Critical
Status
Closed
Resolution
Fixed
Assignee
Jonathan Hung
Reporter
Jonathan Hung
Created
2008-05-07T10:39:49.000-0400
Updated
2011-02-22T16:27:58.616-0500
Versions
  1. 0.3
Fixed Versions
  1. 0.3
Component
  1. OSDPL

Description

Because of Fluid 542, full html is now allowed within OSDPL design pattern content. This should not be allowed for security reasons.

  • determine subset of HTML tags allowed.
  • create help text for OSDPL CCK form explaining what HTML tags are available.

Comments

  • Jonathan Hung commented 2008-05-14T16:14:12.000-0400

    HTML is now filtered, but further security evaluation should be carried out on Drupal.

  • Michelle D'Souza commented 2011-02-22T16:27:58.614-0500

    Closing issues that were resolved for 1.0 and earlier releases.