HTML in Welcome Message displayed as plain text (4278365)

HTML in Welcome Message displayed as plain text

After upgrading to 8.1, any HTML stored in the user console welcome message or placed in after the upgrade now shows up as plain text.

The removal of the ability to use custom code in the Welcome Message is an unintended consequence of mitigating a cross site scripting (XSS) vulnerability in version 8.1. The use of custom code in the welcome message has not been a supported function of the KACE Systems Management Appliance (SMA), although KACE does realize some customers have become accustomed to this functionality.

For 8.1, it is recommended to remove all custom code from the Welcome Message (if left, it will display as plain-text). A more robust, fully supported WYSIWYG editor is expected to be added in the next major release in Q3 of 2018. The new feature will allow customization of the message, but will not allow the use of custom HTML, CSS, JavaScript, etc. It will likely mimic the behavior of the WYSIWYG editor used for the Knowledge Base in the SMA.

ESMAS-3881