Tickets :: [#3751] XSS via X-color

10.04.2006 14:52:26	Chuck Hagenbuch	Comment #2 State ⇒ Resolved	Reply to this comment
Fixed in HEAD and for IMP 4.1.1.

10.04.2006 14:09:10	miksir (at) maker (dot) ru	Comment #1 State ⇒ Unconfirmed Priority ⇒ 1. Low Type ⇒ Bug Summary ⇒ XSS via X-color Queue ⇒ IMP	Reply to this comment
No checks in X-color field. (If show_account_colors on) X-Color field may be created by remote client . For example: X-color: "><!--a75c305b1c0a6022--><script>alert("hello");</script><"