fedora-qa / testdays-web

#47 Persistent XSS on result submission
Closed: Fixed by lbrabec. Opened by sumantrom.

Closed: Fixed
Reopen Issue

Injection of the following payload on the "profile" + "comments" triggers this..
Note this is Stored in the server and everytime you load https://testdays.stg.fedoraproject.org/testday/3 -- 1 will be shown to you on an alert box.

<script>alert(1)</script>

"><script>alert(1)</script>

<script>alert(1)</script>

Screenshot_From_2025-05-15_12-55-51.png

Related commit: 2519317ef3e525debe5141fdffc10325b3967f6c

Looks like no new issues were found, closing for now. Reopen as needed.

Metadata Update from @lbrabec:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/quality/testdays-web/issues/47

Please continue any further discussion there.
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.