Organizr: XSS Vulnerability

[cunderw]

Organizr Version: 2.0.325

Branch: v2-master

WebServer: Nginx

Operating System: Ubuntu

---

Problem Description:

Organizr is vulnerable to XSS attacks
This is a pretty serious security concern for users.
Suggest supporting Content-Security-Policy: script-src 'self' and relying less on inline scripts.

---

Reproduction Steps:

For example append ?error= to the URL of a hosted organizr setup.

---

Errors on screen? If so paste here:

[causefx]

CSP is set using the webserver.
I'll sanitize the rest.