Details
Bug
Resolved
Major
Description
Hi,
Zend_Dojo_Form_Elements_Editor is generated from <texarea /> in Zend_Dojo_View_Helper_Editor and this is security issue. This is in Dijit documentation:
dijit._editor.RichText is the core of dijit.Editor, which provides basic WYSIWYG editing features. It also encapsulates the differences of different js engines for various browsers. Do not use this widget with an HTML <TEXTAREA> tag, since the browser unescapes XML escape characters, like <. This can have unexpected behavior and lead to security issues such as scripting attacks.
http://api.dojotoolkit.org/jsdoc/1.3.2/dijit._editor.RichText
Zend_Dojo_Form_Elements_Editor must be generated from div!
, thank you
Wrote a test to check for the presence of a textarea. Changed Editor to inherit from DijitContainer.