U4-11140 - RTE text shows udi's when rendered

Created by Dave Woestenborghs 21 Mar 2018, 20:48:47 Updated by Sebastiaan Janssen 05 Sep 2018, 14:58:32

Tags: PR Consider for sprint

What did you do?

Added a link and a image in the Rich Text editor (als on in grid) and render the page

What did you expect to happen? No Umbraco "internal" data is shown on my webpage

What actually happened? I see for both the image and the link a data attrabiute called data-udi rendered that contains the udi.

This makes it possible for users to identify a website running Umbraco and they have a piece of internal data available.

Comments

Dave Woestenborghs 21 Mar 2018, 21:24:36

Created a PR for this one : https://github.com/umbraco/Umbraco-CMS/pull/2531


Jeffrey Schoemaker 06 Aug 2018, 06:33:17

Hi @dawoe,

I see why you've created a PR for this, but I think this will create issues for some of the running installations and that is related to this issue: http://issues.umbraco.org/issue/U4-8949. We are using the udi's to update mediapaths in the Richtext Editor and if they're removed in some version we cannot do this anymore.

I do agree that at some time this data shouldn't be 'leaked' anymore, but I think that should be something for v8 if you ask me.

Looking forward to your opinion,

Jeffrey


Sebastiaan Janssen 06 Aug 2018, 07:22:49

@jeffrey.schoemaker@perplex.nl This has also been discussed in the tracker as it is a concern for Slimsy, we're thinking of making it configurable to turn stripping on or off, the default for new installs will be that stripping is enabled. What do you think?


Jeffrey Schoemaker 06 Aug 2018, 07:24:37

@sebastiaan I didn't know that, but I think your solution sounds good. I hope this shouldn't be needed anymore in v8, but I don't know if it's somewhere on the roadmap?


Sebastiaan Janssen 06 Aug 2018, 07:46:09

I would assume we won't exposed UDI's to the frontend on v8 any more, but I haven't checked.


Ronald Barendse 22 Aug 2018, 07:26:22

@sebastiaan Care to elaborate why the UDI is added as data-uid attribute, shouldn't the value in the href attribute be enough? The wrong naming (uid vs udi) is probably a legacy thing I guess?

In any case, I think v8 should only use the href value and just use the UDI (without locallink): umb://document-type/9931BDE0-AAC3-4BAB-B838-909A7B47570E. Query string and/or hash/fragment elements could just be appended, e.g. umb://document-type/9931BDE0-AAC3-4BAB-B838-909A7B47570E?width=400.


Sebastiaan Janssen 05 Sep 2018, 14:58:19

FYI: we're almost done completing the move to the new issue tracker as announced here: https://umbraco.com/blog/a-new-take-on-the-umbraco-issue-tracker/

I am closing the issue here on the old issue tracker, but it will continue on the new issue tracker. The new link is: https://github.com/umbraco/Umbraco-CMS/issues/2921


Priority: Normal

Type: Bug

State: Closed

Assignee:

Difficulty: Normal

Category: Security

Backwards Compatible: True

Fix Submitted: Pull request

Affected versions: 7.7.0, 7.8.0, 7.7.1, 7.7.2, 7.7.3, 7.7.4, 7.7.5, 7.7.6, 7.7.7, 7.7.8, 7.9.0, 7.7.9, 7.7.10, 7.7.11, 7.8.1, 7.7.12, 7.7.13, 7.9.1, 7.9.2

Due in version:

Sprint:

Story Points:

Cycle: