Problem/Motivation

The security update filtered breadcrumbs for XSS and then strips the tags to remove any HTML.

What we should have done was put the breadcrumb into a markup object which provides XSS filtering but allows HTML entities to be properly rendered.

Currently if a user has a page title with an ampersand (&) this is being rendered as & in the breadcrumb title.

Steps to reproduce

Proposed resolution

1. Preprocess breadcrumb text with a markup object to filter but also allow HTML entities.

Remaining tasks

User interface changes

API changes

Data model changes

Comments

richardgaunt created an issue. See original summary.

fionamorrison23’s picture

fionamorrison23 commented
Issue tags: +civictheme-release-1.12.2
richardgaunt’s picture

richardgaunt commented
Assigned: cb » danielgry
Status: Active » Needs review
fionamorrison23’s picture

fionamorrison23 commented
Assigned: danielgry » Unassigned
Status: Needs review » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.