XSS attack on Display Name of registration form ----------------------------------------------- Key: GTNPORTAL-2940 URL: https://issues.jboss.org/browse/GTNPORTAL-2940 Project: GateIn Portal Issue Type: Bug Security Level: Public(Everyone can see) Affects Versions: 3.6.0.Beta01 Reporter: Hai Nguyen Assignee: Trong Tran Labels: done, portal-s70 Fix For: 3.7.0.Final When Display Name of an user contains script, it's executed when going to Dashboard. (logo portlet contains user's display name) Steps to check: * Register new user with display name is "<script>alert('test')</script>" * Login as new user * Go to Dashboard Problem: alert popup is shown.