I have noticed that when I add a text/html module to a page, I am allowed to enter javascript into the "Module Title:" box, and this code will be executed when the page loads.

e.g. try entering  "<script> malicious script')</script>" as the module title and the alert box will pop up when the page is loaded.

I would like to disable the possibility of entering script into the Module title field, does anyone know a way that I could do that?

Cheers

Steve

Rodney,

It's not a huge problem, and we do generally trust people who we give editor rights not to do anything foolish.

But consider the situation where an admin has some 'finger trouble' and accidentally gives edit rights to 'registered users'  for that module rather than the proper editors group. I can prevent script from being entered into the RTE directly by configuration settings (we use Telerik RadEditor for our RTE) and the only other place they would be able to enter stuff is in the module title.

I cant think of any good reason why people should be able to enter scripts into the module title, so I'd just like to prevent the possibility of some nasty XSS attack by limiting input into that box to just plain text.