Skip to content
GitLab
Closed
Issue created by bmortier@bmortierMaintainer

HTML is not escaped in departments descriptions

Description

If you put HTML in a department description field, it gets rendered in the department list.

FusionDirectory Version

1.2

Steps to Reproduce

  1. Create a department
  2. Put <b>FooBar</b><br> is the name. in the description
  3. Look at the department list

Expected behavior:

HTML is escaped

Actual behavior:

HTML is rendered

Additional Information

Department tree in base field is affected as well. Other columns should be checked as well for most objects, and we should make sure 1.4 management class does not have the problem.

Edited by bmortier