Item13739: LoginName is not validated and presents XSS path.

Priority: Security
Current State: Closed
Released In: 2.0.2
Target Release: patch

Applies To: Engine
Component: LoginManager
Branches: master

Reported By: GeorgeClark
Waiting For:
Last Change By: GeorgeClark

This tasks addressed validation or encoding of the parameters used during registration and login.

Registration parameters are now all entity encoded. Previously there was some encoding done, but it was insufficient to block all XSS paths.
The xss path during login was in the generation of an error message. That path is now blocked.

No further administrator action is needed.

Summary	LoginName is not validated and presents XSS path.
ReportedBy	GeorgeClark
Codebase	2.0.1, 2.0.0
SVN Range
AppliesTo	Engine
Component	LoginManager
Priority	Security
CurrentState	Closed
WaitingFor
Checkins	distro:84f4ba6dffef distro:0e35357c4b8c distro:1f82ab0cc4d3
TargetRelease	patch
ReleasedIn	2.0.2
CheckinsOnBranches	master
trunkCheckins
masterCheckins	distro:84f4ba6dffef distro:0e35357c4b8c distro:1f82ab0cc4d3
ItemBranchCheckins
Release01x01Checkins