CDATA output > bug ? [#1824124]

Hi !

i'm using field slideshow within a view to output 4 small thumbs slideshows.
It works all very well, but when i see the CDATA output i'm a bit affraid of what i see and i'm not sure it's normal:

"directory":"sites\u002Test.localhost\u002Fmodules\u002Ffield_slideshow", "classes_array":[ "field-slideshow" ], "attributes_array":[  ], "title_attributes_array":[  ], "content_attributes_array":[  ], "title_prefix":[  ], "title_suffix":[  ], "user":{"uid":"1", "name":"admin", "pass":"XXXXXXXXXXX\XXXXXXX\XXXXXXX\XXXXXXXX", "mail":"myemail@free.fr", "theme":"", "signature":"", "signature_format":null, "created":"1351239968", "access":"1351260737", "login":"1351240030", "status":"1", "timezone":"Europe\u002FBerlin", "language":"", "picture":"0", "init":"myemaile@free.fr", "data":false, "sid":"hsfAvy7gg4RHGNo0NN2nE45N8faQ_Xgc9y_DlA", "ssid":"", "hostname":"107.0.0.1", "timestamp":"1351260739", "cache":"0", "session":"", "roles":{"2":"authenticated user", "3":"administrator"}}, "db_is_active":true, "is_admin":true, "logged_in":true, "is_front":false}, "field-slideshow-3":{"image_style":"", "speed":"1000", "fx":"fade", "timeout":"20000", "order":"", "controls":[  ], "controls_position":"after", "pause":0, "start_on_hover":0, "pager":false, "pager_position":"after", "carousel_visible":"3", "carousel_scroll":"1", "carousel_speed":"500", "carousel_vertical":0, "carousel_circular":0, "carousel_follow":0, "slideshow_id":3, "controls_pause":null, "pager_image_style":null, "carousel_image_style":null, "breakpoints":null, "theme_hook_suggestions":[  ], "zebra":"odd", "id":3,

this is only part of the CDATA output: for 4 slideshows i have 4 times the same thing, with just "id":X changing
now i don't understand why we have things here such as email, user and encoded password !!!

Comment	File	Size	Author
#3	js_cdata_variable-1824124-3.patch	5.42 KB	idflood

Comments

Comment #1

idflood commented 27 October 2012 at 14:29

Assigned:	Unassigned	» idflood
Priority:	Normal	» Major

Thanks for the report. The js variable definitely needs some cleaning, but as I see this there is no major issue about security. It outputs the user and encoded password of the user you are logged in. So if you visit you page as anonymous user there will be no encoded password nor user name (at least not on my quick test).

But still, it outputs way too much info, so I'm marking this issue as major.

I've recently committed a fix which remove the node variable from the $js_variables, so this issue goes in the same direction.