Hello,

Someone in my organization who uses Projector'RIA has noticed that there might be a vulnerability in the Advanced Filters:
it seems that HTML code can be entered into a filter, and it will be interpreted - meaning that possibly, someone could execute HTML code through the Advanced Filter functionality.

Not sure if there are other mechanisms which would prevent any harm being done, but the risk here would be that an "external project leader" for example could use this to access data he normally would not be allowed to see.

So maybe something to check? Apparently the PHP function "htmlentities" could be used to prevent interpretation of Html code.

Screenshot here shows that html tags (bold, underline) are interpreted.