XSS via wallet name on web interface

[theblazehen]

I set my wallet name to <script>alert('XSS');</script> and some time later I got that on the creepminer web interface

[Creepsky]

:smile: This should better be secured!

Also: if the pool or wallet sends html code as a response for a request, the webinterface tries to parse it and executes javascript inside it.

[theblazehen]

Thanks for the quick response. I underestimated the impact that this could have had, otherwise I would have contacted you through more private means rather than adding it all to the ticket.

[Creepsky]

Oh you did nothing wrong, thanks for submitting it! This is exactly what the issue tracker is good for : )

[damccull]

Was this ever solved @Creepsky? Is 1.6+ now secure from this issue?