The input fields 'recipients' and 'message' are not sanitized with check_plain. This could lead to script injection.

CommentFileSizeAuthor
forward_6.patch1.3 KBtiziano

Comments

seanr’s picture

seanr
he/him
commented
Status: Active » Fixed

Thanks, fixed in 5.x-dev. Will show up in a full release later, pending some other work currently ongoing.

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.