This is a followup to #1933716: Use the new SnapEngage javascript API - I forgot to filter the $advanced_script variable before using it in _snapengage_add_snapengage_script() and I guess this is kind of evil because someone, with the necessary privileges, could add XSS code.
So here's the patch to remove the evil - I hope filter_xss_admin() is sufficient.

CommentFileSizeAuthor
snapengage-sanitize-advanced-script-setting.patch496 bytesdas-peter

Comments

arnested’s picture

arnested commented
Status: Needs review » Fixed

Cool.

Applied.

Release 7.x-1.4 is on the way.

arnested’s picture

arnested commented

Just for the record: The reason the patch failed tasting is because I applied it to the 7.x-1.x-dev branch before the testbot got around to testing it.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.