CIVI-SA-2024-02: JSON Settings XSS
Web-pages which use the "Resources" API to inject JSON data ("settings") may create vectors for XSS attacks.
Web-pages which use the "Resources" API to inject JSON data ("settings") may create vectors for XSS attacks.
Within the "View Contact" screen and its sub-pages, there were multiple cross-site scripting vulnerabilities.
What’s this DocBot all about? Well, in short, it’s an AI-based bot that puts the end user, developer and system administrator documentation into a CiviCRM extension that allows fast, efficient Q&A style searches. Basically, it puts the entire CiviCRM documentation at your fingertips, providing answers and how-to style guidance in-app.
Don’t worry… the docs are NOT going away! In fact, they are as important as ever!
It’s been a few months since Mathieu reworked version 1 of the contributor listing using SearchKit. You can see it in action at https://civicrm.org/civicrm/contributors
Let me start by saying that it isn’t perfect, meaning that it doesn’t capture every contribution from every corner of the CiviVerse, nor will it display past contributors that are now inactive (at least not without them following the process detailed below).
One of the most powerful and important features of FormBuilder is arguably the most complex, hence why we’ve been patient (some might say ‘slow’) in its implementation. We’re talking about support for contributions, i.e. processing payments, in FormBuilder
But, as the saying goes in the great country of Texas, it’s time to “take the bull by the horns”.
Exciting, we know, though maybe not for the bull. Anyhow, before we get saddled up, let’s set a few expectations up front: