Wiki sharing broken

Malendur

Wed, 15 May 2019 00:19:40 +0300

!zotlabs.org | Hubzilla Development

Sharing a wiki page is broken because the # in the body parameter (in #^[zrl=...) is not escaped.
Escaping manually in the URL fixes it.
Can someone confirm that (and create an issue, or even a MR)?
Thanks

hubzilla

Xanthor

Fri, 17 May 2019 06:49:58 +0300

I think this is a security issue.
Try to create a wiki page with the title "><script>window.alert('bug')</script> and see...

Mario Vavti

Fri, 17 May 2019 13:53:18 +0300

Those issues are probably fixed in recent master...

Malendur

Wed, 05 Jun 2019 10:14:29 +0300

Yes, it's fixed in 4.2. Thanks!