-
-
Notifications
You must be signed in to change notification settings - Fork 290
Closed
Labels
Milestone
Description
Describe the problem
Hi,
Looks like #358 wrongly "fixed" an XSS in the input side instead of in the HTML rendering side.
Feels to me like fixing an SQL injection by disallowing quotes in passwords.
Also I am not aware of a spec disallowing HTML in DNS TXT records.
I have not searched extensively if there's an XSS in poweradmin though, but I currently have HTML in a TXT record (probably set manually then), and it is properly HTML encoded in the textarea of index.php?page=edit.
As said in the last sentence: I currently have HTML in a TXT record and cannot modify it, I'm getting Error: You cannot use html tags for this type of record..
Steps to reproduce
- Go to the
index.php?page=editpage of a domain. - Create (or edit) a TXT record with some HTML in it like
<img src=/foo.jpg> - Get
Error: You cannot use html tags for this type of record.
Poweradmin version
v3.8.1, but the test still exists on master.
Database
PostgreSQL
Additional information (optional)
No response
Reactions are currently unavailable