<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Hi List,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">So I’m still using OpenCMS 10.0.0 as I’m encountering issues with the upgrade to 11, however with my current install of 10, I’m noticing in the site search that JavaScript script can be run from the site search input for example if someone
were to search the following <span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black;background:white">"><script type="text/javascript">alert("hello");</script> the alert is executed. I’m using a cloned version of the Apollo template and
have not made any changes to the jsp-search-formatter.jsp<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black;background:white"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black;background:white">From what testing I’ve done I believe the issue arises due to the beginning characters the “> not being escaped properly as searching only <script
type="text/javascript">alert("hello");</script> does not execute the script…</span><o:p></o:p></p>
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:#1F497D">Gratian Francis<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="color:#1F497D">Junior Programmer Analyst<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">CancerCare Manitoba<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">CC40-825 Sherbrook Street<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Winnipeg, MB R3A 1M5<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Cell: 204-794-1230<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="color:#1F497D"><a href="mailto:gfrancis2@cancercare.mb.ca"><span style="color:blue">gfrancis2@cancercare.mb.ca</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial","sans-serif";color:#1F497D"><img border="0" width="286" height="57" id="Picture_x0020_1" src="cid:image001.png@01D54392.A6D15300" alt="CCMB-transparent-small"></span><span lang="EN-CA" style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-CA" style="color:#C0504D">Planned Absences 2019:<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span lang="EN-CA" style="color:#C0504D">July 2<sup>nd<o:p></o:p></sup></span></b></p>
<p class="MsoNormal"><b><span lang="EN-CA" style="color:#C0504D">July 19<sup>th</sup>
<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span lang="EN-CA" style="color:#C0504D">Afternoon of August 30<sup>th</sup><o:p></o:p></span></b></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>