Magento & lt; 1.9 xss vulnerability Repair Process

Magento <1.9 xss vulnerability fix Process

The magento XSS vulnerability is not introduced. Baidu is everywhere.

Here, we will simply record the processing process (relatively crude, whether it is valid or not, not verified)

Edit

App/design/adminhtml/default/template/sales/order/view/info. phtml

File

Search getCustomerEmail

There are two output calls

You can use the htmlentities method to filter and process as follows:

1 2 3 4 5 6 7 GetCustomerEmail ();?> "> GetCustomerEmail ();?>

PS: The main cause is that the cloud ECS always prompts security issues. After such handling, the annoying prompt will be gone. As to whether it is valid or not, you can verify if you need it. If you have any questions, please click it :)