If you ever touch our Freemarker code, you need to be aware that we have
changed the way that HTML is escaped. Don't use ?html any more.
Freemarker is now upgraded to the latest version which provides
automatic escaping of all variables by default. The ?html suffix is no
longer allowed. This is far more secure as we err on the side of caution.
If you intend to include html in a Freemarker variable value you need to
tell Freemarker that it shouldn't escape it. Use the ?no_esc suffix.
For example, let's say you have a message bundle entry that looks like this:
totpStep1=Install <a href="https://myurl/">FreeOTP</a> or Google
Authenticator on your device.
In Freemarker, you need to say:
Also, be aware that you are responsible for the safety of anything
marked with ?no_esc. Make sure there is no way it can be modified from
outside Keycloak or you will be opening Keycloak to an XSS attack.
Show replies by date