Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

Possible [minor] injection risk

#27

Default generator adds a flash[:error] with unescaped params[:login] to session controller. One can simply inject arbitrary javascript code into login box.

Reported by Reza · November 17th, 2008 @ 01:09 AM

State: new
Milestone: none
Assigned to: mrflip mrflip

Activity

No comments yet.

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.