Skip to content

Commit dc27406

Browse files
adriendupuisdabrt
andauthored
Apply suggestions from code review
Co-authored-by: Tomasz Dąbrowski <[email protected]>
1 parent 488279c commit dc27406

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

docs/infrastructure_and_maintenance/security/security_checklist.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -147,9 +147,9 @@ Reduce your attack surface by exposing only what you must.
147147
### Limit access to Code blocks
148148

149149
The [Code block]([[= user_doc =]]/content_management/block_reference/#code-block) in Page Builder is designed to accept any HTML, which includes embedded JavaScript.
150-
This means that malicious JS including [cross site scripting (XSS)](https://en.wikipedia.org/wiki/Cross-site_scripting) is necessarily possible for editors that have access to Code blocks.
151-
As site administrator you should be aware of this when giving editors access to the Page Builder features, and limit that access only to highly trusted editors.
152-
It is possible to [limit access to specific blocks per content type]([[= user_doc =]]/content_management/configure_ct_field_settings/#default-configuration-of-pages), where you can define which page blocks are available to an editor.
150+
This means that editors who have access to Code blocks could add malicious JS including [cross site scripting (XSS)](https://en.wikipedia.org/wiki/Cross-site_scripting).
151+
As site administrator, be aware of this when giving editors access to the Page Builder features, and limit that access only to trusted editors.
152+
You can [limit access to specific blocks per content type]([[= user_doc =]]/content_management/configure_ct_field_settings/#default-configuration-of-pages) by defining which page blocks are available to editors.
153153

154154
## Symfony
155155

0 commit comments

Comments
 (0)