There is insufficient escaping on an element in the v_devices_collection.php template in Open-AudIT Community.
To address this issue, edit line 199 in the file below.
Windows - c:\xampp\open-audit\code_igniter\application\views\theme-bootstrap\v_devices_collection.php
Linux : /usr/local/open-audit/code_igniter/application/views/theme-tango/v_devices_collection.php
In 3.3.2 the line looks as below.
echo '<span class="label label-info">' . $item->name . ' ' . $item->operator . ' ' . urldecode($item->value) . ' <a href="' . $link . '">×</a></span> ';
In 3.4.0 the line looks as below.
echo '<span class="label label-info">' . htmlentities($item->name) . ' ' . htmlentities($item->operator) . ' ' . urldecode($item->value) . ' <a href="' . $link . '">×</a></span> ';
To negate the issue, change the line as below.
echo '<span class="label label-info">' . htmlentities($item->name) . ' ' . htmlentities($item->operator) . ' ' . htmlentities(urldecode($item->value)) . ' <a href="' . $link . '">×</a></span> ';
Apologies for any inconvenience.
This has been addressed for our next release.