Details
-
Type:
Bug
-
Status: Done/Fixed
-
Priority:
Major
-
Resolution: Fixed/Completed
-
Affects Version/s: 4.7
-
Fix Version/s: 4.7.14
-
Component/s: None
-
Security Level: Security - Published
-
Labels:None
-
Versioning Impact:Patch (backwards-compatible bug fixes)
-
Documentation Required?:None
-
Funding Source:Core Team Funds
-
Verified?:No
Description
Contacts with special characters in their names like < or & do not display properly in quicksearch (double-escaped) or entityRef fields (unescaped). The latter is a potential xss vector.
There was some additional unescaped output in common.js which I have fixed.