kanboard-kanboard

8 Commits 1 Branch 0 Tags

2 Commits

Include renames

Author	SHA1	Message	Date
dualfroz	bb891e182e	fix(security): escape the project name in the analytic modal title LayoutHelper::analytic() prefixes the title with the raw project name, and the AJAX branch of analytic/layout.php printed that title as is, so a project name containing markup was injected into the analytic modals. Escape it with $this->text->e() like the other layouts do. It does not double-encode, so the ">" separator still renders as ">".	2026-10-03 15:58:07 +02:00
upstream	392b2d737b	Upstream kanboard/kanboard state of the touched files before 2e3f570f88	2026-10-02 16:19:49 +02:00

Author

SHA1

Message

Date

dualfroz

bb891e182e

fix(security): escape the project name in the analytic modal title

LayoutHelper::analytic() prefixes the title with the raw project name, and
the AJAX branch of analytic/layout.php printed that title as is, so a
project name containing markup was injected into the analytic modals.

Escape it with $this->text->e() like the other layouts do. It does not
double-encode, so the "&gt;" separator still renders as ">".

2026-10-03 15:58:07 +02:00

upstream

392b2d737b

Upstream kanboard/kanboard state of the touched files before 2e3f570f88

2026-10-02 16:19:49 +02:00