Persistent XSS on public project page

Details A project admin can set up a custom issue tracker integration. This setting misses a check to make sure that it's a real URL and, thus, can use the `javascript` handler to execute arbitrary Javascript. Browsers use this handler to execute inline Javascript. This can lead to an account take …

javascript:alert("Current user its API token: " + window.gon.api_token);