Firefox cross-site scripting issue

[joelcc]

I went ahead and added the following to my servercontroller

procedure TController.IWServerControllerBaseParseParameter(var AParam: string;
var AllowIt: Boolean; const Index: Integer);
begin

if ContainsText(AParam, 'onbeforescriptexecute') then
AllowIt := False;

end;

NOW they are coming back and saying that I also need to also check for onafterscriptexecute. (Can you also please add this one to your code base?)

I know I can add the following to the servercontroller, but it there a way to block everything and only allow what I need to pass through?

if ContainsText(AParam, 'onafterscriptexecute') then
AllowIt := False;