# Possible security issue with discourse retort emojis
**URL:** https://meta.discourse.org/t/possible-security-issue-with-discourse-retort-emojis/227098
**Category:** Support
**Created:** [May 15, 2022, 8:43pm UTC](https://meta.discourse.org/t/possible-security-issue-with-discourse-retort-emojis/227098 "2022-05-15T20:43:00Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Arisa](https://meta.discourse.org/u/Arisa)
#### Post date: [May 15, 2022, 8:43pm UTC](https://meta.discourse.org/t/possible-security-issue-with-discourse-retort-emojis/227098/1 "2022-05-15T20:43:00Z")
Hii
so basically server doesn’t check if the emoji sent by the client is valid so the client is able to change “title” and “alt” attributes for the emoji \![]()
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [May 15, 2022, 9:12pm UTC](https://meta.discourse.org/t/possible-security-issue-with-discourse-retort-emojis/227098/2 "2022-05-15T21:12:10Z")
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [May 15, 2022, 9:12pm UTC](https://meta.discourse.org/t/possible-security-issue-with-discourse-retort-emojis/227098/3 "2022-05-15T21:12:25Z")
Not following, can you reply with an example? This looks like retort which is not an official plugin. Discourse reactions renders differently.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [May 15, 2022, 9:13pm UTC](https://meta.discourse.org/t/possible-security-issue-with-discourse-retort-emojis/227098/4 "2022-05-15T21:13:59Z")
---
### Author:  [@Arisa](https://meta.discourse.org/u/Arisa)
#### Post date: [May 15, 2022, 9:17pm UTC](https://meta.discourse.org/t/possible-security-issue-with-discourse-retort-emojis/227098/5 "2022-05-15T21:17:49Z")
Ah, so it’s an external plugin, I had no idea.
Yes, it seems to be retort from the body of the request when reacting with emoji.
---
### Author:  [@Arisa](https://meta.discourse.org/u/Arisa)
#### Post date: [May 15, 2022, 9:27pm UTC](https://meta.discourse.org/t/possible-security-issue-with-discourse-retort-emojis/227098/6 "2022-05-15T21:27:02Z")
[https://github.com/gdpelican/retort/issues/76](https://github.com/gdpelican/retort/issues/76)
it’s even reported on the repo so yeah
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [May 15, 2022, 11:45pm UTC](https://meta.discourse.org/t/possible-security-issue-with-discourse-retort-emojis/227098/7 "2022-05-15T23:45:51Z")
For future travelers here, our official plugin is:
> [@Discourse Reactions](https://meta.discourse.org/t/discourse-reactions-beyond-likes/183261):
>
> discourse2Summary Discourse Reactions allows users to React to a post from a choice of emojis, rather than only the Like heart. The available emoji selection can be set from the admin settings.open_bookInstall Guide This plugin is bundled with Discourse core. There is no need to install the plugin separately. Bored of likes in discourse? Here’s something you will definitely love. Overview Discourse-reactions is a plugin that allows user to add their reactions to the …
This issue does not impact the official plugin.