Update admin interface #1053

New Issue

MrUnknownDE · 2026-04-06T01:34:11+02:00

MrUnknownDE commented

2026-04-06 01:34:11 +02:00

Originally created by @BlackDex on 7/11/2024

Updated datatables
Set Cookie Secure flag if the connection is https
Prevent possible XSS via Organization Name
Converted all innerHTML and innerText to the Safe Sink version textContent
Removed jsesc function as handlebars escapes all these chars already and more by default

Fixes: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39926

*Originally created by @BlackDex on 7/11/2024* - Updated datatables - Set Cookie Secure flag if the connection is https - Prevent possible XSS via Organization Name Converted all `innerHTML` and `innerText` to the Safe Sink version `textContent` - Removed `jsesc` function as handlebars escapes all these chars already and more by default Fixes: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39926

MrUnknownDE closed this issue

2026-04-06 01:34:11 +02:00

Sign in to join this conversation.

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/vaultwarden#1053