Item6001: diff cannot be shown if using javascript in topic
Priority: Normal
Current State: No Action Required
Released In: n/a
Target Release: n/a
Applies To: Engine
Component:
Branches:
The diff between revision cannot be shown if using javascript in Topic such as
<img alt="kungfu.jpg" src="%ATTACHURL%/kungfu.jpg" />
<SCRIPT LANGUAGE="JavaScript">
alert('You wanna learn what security is?');
window.location="http://www.google.com/search?q=software+security+wiki&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official";
</script>
--
TWiki:Main/HieuLeTrung - 17 Sep 2008
adding a new rev to show diff
--
TWiki:Main.SvenDowideit - 05 Oct 2008
The problem here is that diff doesn't defuse/disable JS.
--
CrawfordCurrie - 27 Jun 2010
Just tried it on 1.1.9 and 1.2.0, and it seems to be fine.
--
CrawfordCurrie - 17 Feb 2015