matthias/mayan-edms
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Avoid setting window.location directly to avoid exploit of cross site scripting. Thanks to Lokesh (@lokesh1095) for the report and solution. Closes GitLab issue #494.

Browse Source 
Signed-off-by: Roberto Rosario <roberto.rosario.gonzalez@gmail.com>
This commit is contained in:
Roberto Rosario
2018-08-16 18:46:10 -04:00
parent ed76278096
commit 9ebe80595a
2 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
HISTORY.rst
View File

@@ -36,6 +36,9 @@
links' icons.
- Documents app: Hide the title link of documents in the trash.
- Workflow app: Define a redirection after workflow actions are edited.
- Appearance app: avoid setting window.location directly to avoid exploit
of cross site scripting. Thanks to Lokesh (@lokesh1095) for the report
and solution. Closes GitLab issue #494.
3.0.1 (2018-07-08)
=================

2
mayan/apps/appearance/templates/appearance/base_plain.html
View File

@@ -34,7 +34,7 @@
// template.
var currentHash = window.location.hash;
if (currentHash.length) {
window.location = currentHash.substring(1);
window.location.pathname = currentHash.substring(1);
}
function waitForJQuery(func) {