Comments (5)
sanluan
commented on August 23, 2024
抱歉 这个问题暂时没办法避免 文章正文必须是富文本的
下个版本将会把投稿内容和普通内容区分开 审核前 取消投稿的预览
from publiccms.
wind226
commented on August 23, 2024
抱歉，这个问题暂时没办法避免文章正文必须是富文本的
下个版本将会把投稿内容和普通内容区分开审核前取消投稿的预览
你可以过滤敏感字符，或者转义双引号，单引号，尖括号就能避免xss
from publiccms.
sanluan
commented on August 23, 2024
刚才提交了代码 目前的解决方法是标识投稿文章，对于未审核的投稿文章 默认做安全转义
from publiccms.
wind226
commented on August 23, 2024
先前提交了代码目前的解决方法是标识投稿文章，对于未审核的投稿文章默认做安全转义
做安全转义这个办法是可以
from publiccms.
sanluan
commented on August 23, 2024
非常感谢发现的这个bug
from publiccms.
Related Issues (20)
- Found a storage type xss vulnerability In the latest version
- 授权价格明细数据在哪可以看到？ HOT 1
- Should we remove unnecessary 'public' in interface? HOT 2
- There is a SSRF vulnerability via /publiccms/admin/ueditor HOT 1
- The default bat file parameters are controllable, resulting in rce HOT 1
- Who to contact for security issues
- # HOT 8
- 管理后台的文件管理存在xss漏洞 HOT 7
- There is an XSS vulnerability in managing background file management HOT 1
- 后台存储型xss HOT 2
- /SysDatasourceAdminController.java/save 受mysql恶意服务器影响 HOT 2
- A vulnerability exists in PublicCMS V4.0.202204.d and below, Cross-site request forgery(CSRF) HOT 1
- A vulnerability exists in PublicCMS V4.0.202302.c and below, Arbitrary file write HOT 2
- Unable to load static files HOT 3
- Admin backend RCE HOT 1
- 初始化只能通过localhost访问吗 HOT 2
- Trigger deserialization rce through redis cache
- There is an SSRF vulnerability in publiccms V4.0.202302.e, whice allow attackers to access the website of intranet or detect whether the port is open HOT 1
- There is a SSRF vulnerability in the lastest version of PublicCMS- V4.0.202302.e HOT 3
- There is an xss vulnerability caused by file uploads in PublicCMS V4.0 HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from publiccms.