Forum Discussion

sateesh999's avatar
sateesh999
Contributor
6 years ago

"><img src=x onerror=alert('testing')>

Hello, If I enter alert code or any script into the subject field and after posting my message If I refresh or click on the home page then A popup is showing and says  (testing) with an OK button. ...
Claudius's avatar
Claudius
Boss
6 years ago

Hi Sateesh,

Are you an admin in your community? Your permissions are then probably overriding the content filters. Normal users posting active script elements in the subject or body should see any active content getting removed.

  • sateesh999's avatar
    sateesh999
    Contributor
    6 years ago

    Hi 

    Claudius ,

    Thanks for your reply.

    I am not an admin, But If any other user injects the script into the subject area then the popup box is appearing on the page. It's a security issue.

    As per your message we need to check with the content filters right?

     

    Thanks.

    Sateesh.

    • Claudius's avatar
      Claudius
      Boss
      6 years ago

      Yes, I suggest you work directly with the community team in your community to raise this issue and have it investigated.

      It's also important to mention whether you are using the community message editor to post this subject or if you are using the API the get it posted. There are different filters and checks applied for each. Most important is your permission set tied to your role though.