security issue/bug

[gobezu]

being new to this community i have no idea where to post bugs
but i found out the following trying to install the who's online module

after uploading the module i could not get anywhere due to the unescaped quote which rendered js error
i guess this should have properly been escaped in PackageManagerDisplay::createJavascriptModuleArray
using for instance htmlspecialchars($module['name'], ENT_QUOTES)

cheers
/gobezu

[kbrill]

being new to this community i have no idea where to post bugs
but i found out the following trying to install the who's online module

after uploading the module i could not get anywhere due to the unescaped quote which rendered js error
i guess this should have properly been escaped in PackageManagerDisplay::createJavascriptModuleArray
using for instance htmlspecialchars($module['name'], ENT_QUOTES)

cheers
/gobezu

Where did you download the Who's Online module. I wrote the 4.5.1 and it doesn't use any Javascript.

[gobezu]

thanks for a cool module
the issue is not that much related with the module in itself as much as with the PackageManagerDisplay, and the js error shows right after uploading the module