Forum Discussion
_anomDiebolt_
8 years agoQrew Elite
Working demo:
HTML Report Description ~ List All
https://haversineconsulting.quickbase.com/db/bmwtjd4pk?a=q&qid=1
Pastie Database
https://haversineconsulting.quickbase.com/db/bgcwm2m4g?a=dr&rid=588
Notes:
(1) The HTML decoding was not applied to the table homepage where the raw HTML markup appears unrendered:
https://haversineconsulting.quickbase.com/db/bmwtjd4pk?a=td
(2) There is an unlikely scenario where this might be abused. Although an admin is the only person that could implement this script, once implemented it might be possible for a user to add script to his own report description and then lure others to visit that report.
<script>alert("xss");</script>
As a general rule an administrator should have a sufficient level of trust of all users with rights to create reports if they intent to implement this feature.
HTML Report Description ~ List All
https://haversineconsulting.quickbase.com/db/bmwtjd4pk?a=q&qid=1
Pastie Database
https://haversineconsulting.quickbase.com/db/bgcwm2m4g?a=dr&rid=588
Notes:
(1) The HTML decoding was not applied to the table homepage where the raw HTML markup appears unrendered:
https://haversineconsulting.quickbase.com/db/bmwtjd4pk?a=td
(2) There is an unlikely scenario where this might be abused. Although an admin is the only person that could implement this script, once implemented it might be possible for a user to add script to his own report description and then lure others to visit that report.
<script>alert("xss");</script>
As a general rule an administrator should have a sufficient level of trust of all users with rights to create reports if they intent to implement this feature.