Headline
CVE-2022-1290: chore(security): fix issue where html was allowed in some input fields · polonel/trudesk@4f48b3b
Stored XSS in "Name", “Group Name” & “Title” in GitHub repository polonel/trudesk prior to v1.2.0. This allows attackers to execute malicious scripts in the user’s browser and it can lead to session hijacking, sensitive data exposure, and worse.
Permalink
Browse files
chore(security): fix issue where html was allowed in some input fields
- Loading branch information
Showing with 42 additions and 19 deletions.
- +11 −1 src/helpers/utils/index.js
- +2 −1 src/models/attachment.js
- +3 −2 src/models/department.js
- +2 −1 src/models/group.js
- +3 −1 src/models/notice.js
- +3 −2 src/models/role.js
- +3 −2 src/models/tag.js
- +3 −2 src/models/team.js
- +2 −1 src/models/ticket.js
- +2 −1 src/models/ticketpriority.js
- +2 −1 src/models/tickettype.js
- +6 −4 src/models/user.js