Uploaded image for project: 'OFBiz'
  1. OFBiz
  2. OFBIZ-1525 Issue to group security concerns
  3. OFBIZ-12098

Make ruleName field in PriceForms.xml#AddPriceRules safe

    XMLWordPrintableJSON

    Details

    • Type: Sub-task
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: Trunk
    • Fix Version/s: 18.12.01, 17.12.05
    • Component/s: product/catalog
    • Labels:
      None
    • Sprint:
      Bug Crush Event - 21/2/2015

      Description

      I noticed an issue due to entity-auto. Unlike with a standard service you can't protect fields using allow-html="safe" except by overriding fields. So in case this must be done one by one...

      An example is ruleName field in PriceForms.xml#AddPriceRules with createProductPriceRule and updateProductPriceRule services

      See https://markmail.org/message/osdv2bfpyjuu4tol

        Attachments

          Activity

            People

            • Assignee:
              jleroux Jacques Le Roux
              Reporter:
              jleroux Jacques Le Roux
            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: