# 🎉 Node-RED 0.20.8 released

**URL:** <https://discourse.nodered.org/t/node-red-0-20-8-released/15192>\
**Category:** News\
**Created:** [6 September 2019 09:41 UTC](https://discourse.nodered.org/t/node-red-0-20-8-released/15192 "2019-09-06T09:41:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [6 September 2019 09:41 UTC](https://discourse.nodered.org/t/node-red-0-20-8-released/15192/1 "2019-09-06T09:41:52Z")

</div>

I've just published Node-RED 0.20.8. It contains two fixes:

- Sanitize tab name in edit dialog - this fixes a potential XSS issue where a well-formed (or badly formed, depending on your perspective) flow name could be used to inject javascript into the editor.

- Pass httpServer to runtime even when httpAdmin disabled Fixes #2272  
This fixes an issue where if you disabled the HTTP Admin and Editor (by setting `httpAdminRoot` to `false`, Node-RED Dashboard would stop working. This means it is now much easier to create an instance of Node-RED that only exposes the dashboard and does not allow any admin access.

Enjoy!

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [6 September 2019 10:50 UTC](https://discourse.nodered.org/t/node-red-0-20-8-released/15192/2 "2019-09-06T10:50:17Z")

</div>

> [@knolleary](#):
>
> Pass httpServer to runtime even when httpAdmin disabled Fixes

That's interesting, would that have stopped uibuilder from working as well as it also uses the ExpressJS `app`?

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [6 September 2019 10:52 UTC](https://discourse.nodered.org/t/node-red-0-20-8-released/15192/3 "2019-09-06T10:52:00Z")

</div>

It caused `RED.server` to be null when it shouldn't have been. If uibuilder uses `RED.server` (for example, to create a websocket listener) then yes, it would have been affected.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [6 September 2019 13:45 UTC](https://discourse.nodered.org/t/node-red-0-20-8-released/15192/4 "2019-09-06T13:45:07Z")

</div>

Doh!

> <https://github.com/TotallyInformation/node-red-contrib-uibuilder/blob/1e60585a0d4cf6f9425f894d179a799cedaa587f/nodes/uibuilder.js#L203-L203>

Too many things to test!

Thanks for fixing.