Problem with Views Slideshow interaction

Depends if your already updated to 7.x-1.x-dev is current or not.

You're describing SA-CONTRIB-2012-057 which was fixed about a year ago.

Then it must be a false positive. Have you tried the above in your site? Does the alert pop-up?

At this point, I'm not sure where the problem is.. The module filters out that type of attack, so this shouldn't be possible anymore.. And you're telling me that it only happens on Views Slideshow pages.. Might be some weird interaction print and views_slideshows.

Does the XSS injection also work on those pages when you use the same url, but with node instead of print?

Honestly, at this moment I'd have to reproduce it. And I can't.

I've created a security issue with the security team (which is what you should done to begin with, but that's moot now). Maybe we'll be able to understand what type of conditions can trigger this.

Closing this as a duplicate of the security issue.

Sorry for re-openning this issue, but I have a problem with this commit: 2b7a3610f75a2c62a8b0ceabf1a01b0ddc92b44d
It broke putting an image on generated PDF file.

In my module:

function HOOK_preprocess_entity(&$variables)
{
  $file = file_load(3);
  $variables['logo_uri'] = $file->uri;
}

In my template:

<td width=200><img src="<?php print $logo_uri; ?>" typeof="foaf:Image" />

One commit behind, the image shows OK!
But on this commit, the image can't load.

Thanks in advance