We have moved to GitHub Issues
You are viewing the read-only archive of Umbraco's issue tracker. To create new issues, please head over to GitHub Issues.
Make sure to read the blog posts announcing the move for more information.
Created by Dave Woestenborghs 21 Mar 2018, 20:48:47 Updated by Sebastiaan Janssen 05 Sep 2018, 14:58:32
Tags: PR Consider for sprintWhat did you do?
Added a link and a image in the Rich Text editor (als on in grid) and render the page
What did you expect to happen? No Umbraco "internal" data is shown on my webpage
What actually happened? I see for both the image and the link a data attrabiute called data-udi rendered that contains the udi.
This makes it possible for users to identify a website running Umbraco and they have a piece of internal data available.
Created a PR for this one : https://github.com/umbraco/Umbraco-CMS/pull/2531
Hi @dawoe,
I see why you've created a PR for this, but I think this will create issues for some of the running installations and that is related to this issue: http://issues.umbraco.org/issue/U4-8949. We are using the udi's to update mediapaths in the Richtext Editor and if they're removed in some version we cannot do this anymore.
I do agree that at some time this data shouldn't be 'leaked' anymore, but I think that should be something for v8 if you ask me.
Looking forward to your opinion,
Jeffrey
@jeffrey.schoemaker@perplex.nl This has also been discussed in the tracker as it is a concern for Slimsy, we're thinking of making it configurable to turn stripping on or off, the default for new installs will be that stripping is enabled. What do you think?
@sebastiaan I didn't know that, but I think your solution sounds good. I hope this shouldn't be needed anymore in v8, but I don't know if it's somewhere on the roadmap?
I would assume we won't exposed UDI's to the frontend on v8 any more, but I haven't checked.
@sebastiaan Care to elaborate why the UDI is added as data-uid
attribute, shouldn't the value in the href
attribute be enough? The wrong naming (uid
vs udi
) is probably a legacy thing I guess?
In any case, I think v8 should only use the href
value and just use the UDI (without locallink
): umb://document-type/9931BDE0-AAC3-4BAB-B838-909A7B47570E
. Query string and/or hash/fragment elements could just be appended, e.g. umb://document-type/9931BDE0-AAC3-4BAB-B838-909A7B47570E?width=400
.
FYI: we're almost done completing the move to the new issue tracker as announced here: https://umbraco.com/blog/a-new-take-on-the-umbraco-issue-tracker/
I am closing the issue here on the old issue tracker, but it will continue on the new issue tracker. The new link is: https://github.com/umbraco/Umbraco-CMS/issues/2921
Priority: Normal
Type: Bug
State: Closed
Assignee:
Difficulty: Normal
Category: Security
Backwards Compatible: True
Fix Submitted: Pull request
Affected versions: 7.7.0, 7.8.0, 7.7.1, 7.7.2, 7.7.3, 7.7.4, 7.7.5, 7.7.6, 7.7.7, 7.7.8, 7.9.0, 7.7.9, 7.7.10, 7.7.11, 7.8.1, 7.7.12, 7.7.13, 7.9.1, 7.9.2
Due in version:
Sprint:
Story Points:
Cycle: