Commit 60ec7cd8 authored by Rafael Monnerat's avatar Rafael Monnerat

slapos_jio: fixup! Render text/html as html on domsugar

parent 1cc7ed6a
Pipeline #22933 failed with stage
in 0 seconds
...@@ -11,19 +11,19 @@ ...@@ -11,19 +11,19 @@
}) })
.onStateChange(function () { .onStateChange(function () {
var gadget = this, var gadget = this,
header_text = "By " + gadget.state.author + header_text = "By <strong>" + gadget.state.author +
" on " + gadget.state.modification_date + ":", "</strong> on " + gadget.state.modification_date + ":",
header = domsugar("div", { header = domsugar("div", {
class: "slapos-event-discussion-message-header" class: "slapos-event-discussion-message-header"
}, [ }, [
domsugar('p', {text: header_text}) domsugar('p', {html: header_text})
  • @rafael beware of using html attribute. This allow XSS injection (what if the gadget.state.author contain html?). Instead, you should do something like:

    header_text_element = domsugar('p', [
      'By ',
      domsugar('strong', {text: gadget.state.author}),
      ' on ',
      gadget.state.modification_date,
      ':'
    ])
  • Thanks, I forgot I could use raw string at the list.

Please register or sign in to reply
]); ]);
if (gadget.state.content_type === 'text/html') { if (gadget.state.content_type === 'text/html') {
return domsugar(gadget.element, {}, [ return domsugar(gadget.element, {}, [
header, header,
domsugar('div', { domsugar('div', {
class: "slapos-event-discussion-message-body", class: "slapos-event-discussion-message-body",
text: gadget.state.text_content html: gadget.state.text_content
  • @rafael if you want to inject HTML in the page, please use the html_viewer gadget which cleans the html input.

  • I didnt know this gadget, I will check it.

Please register or sign in to reply
}) })
]); ]);
} }
......
...@@ -236,7 +236,7 @@ ...@@ -236,7 +236,7 @@
</item> </item>
<item> <item>
<key> <string>serial</string> </key> <key> <string>serial</string> </key>
<value> <string>1000.58263.12906.59494</string> </value> <value> <string>1001.26171.19762.42854</string> </value>
</item> </item>
<item> <item>
<key> <string>state</string> </key> <key> <string>state</string> </key>
...@@ -254,7 +254,7 @@ ...@@ -254,7 +254,7 @@
</tuple> </tuple>
<state> <state>
<tuple> <tuple>
<float>1655128468.51</float> <float>1659986314.17</float>
<string>UTC</string> <string>UTC</string>
</tuple> </tuple>
</state> </state>
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment