• This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn more.

Fixed Template name is not escaped

batpool52!

Well-known member
#1
If you copy
Code:
<script>alert("meow")</script>
and paste it in title of a template, you will get a alert which I believe should be escaped before setting the title name in tabs.
 

Mike

XenForo developer
Staff member
#2
This is fixed now, including a case where an error message would print it back unescaped. It doesn't appear that anything nefarious can be done though as the value can only be controlled by typing directly into the template title and the value can't actually be saved because it's not a valid template name.