ieb/timetables — Issue #31: Audit status message allows arbitary HTML, is vulnerable to XSS
Author: h4l
Created: 2012-01-06 12:36:03+00:00
State: open

Arbitrary HTML can be specified for an audit status message. For example, one could set their status message as:

```This is a message with some bold text which executes some javascript: ```

Which results in the javascript in the script tag being executed for anyone viewing the status message.

Sadly there are almost certainly many other instances of such vulnerability in the codebase.