[VCL-808] vcld allows user values that contain HTML which is not cleaned on web interface

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Won't Fix
• Affects Version/s: 2.3.2
• Fix Version/s: 2.5
• Component/s: vcld (backend)
• Assignee: Unassigned
• Reporter: Karl Vollmer
• Created: 21/Jan/15 19:15
• Updated: 20/Mar/17 22:15
• Resolved: 20/Mar/17 22:15

Description

put in HTML/Javascript for a users first name, it makes it into the database and is displayed and executed on the web interface

Example: ./vcld -setup
Add user with a firstname of "<b>Bol</b>"
Lookup the user on the web interface