HTML special characters in the names of content types are not properly sanitized before being displayed on the settings page. I have included a patch for version 6.x-2.1 which could correct this issue.

As it would require administer content types to exploit it as an XSS vulnerability, it would not be considered a security issue based on the following public service announcement: http://drupal.org/node/372836

CommentFileSizeAuthor
#1 og.admin_.inc_.patch510 bytesmbarbella
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

mbarbella’s picture

mbarbella CreditAttribution: mbarbella commented
FileSize
og.admin_.inc_.patch510 bytes
amitaibu’s picture

amitaibu
Primary language Hebrew
Location Israel
CreditAttribution: amitaibu commented
Priority: Normal » Critical
Status: Active » Needs review

Marking correct status - i'll review in the beginning of the week.

amitaibu’s picture

amitaibu
Primary language Hebrew
Location Israel
CreditAttribution: amitaibu commented
Status: Needs review » Fixed

Fixed, thanks!

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.