Commit 813a17a1 authored by Rafael Monnerat's avatar Rafael Monnerat

slapos_jio: Dont use domsugar raw html

   This can lead to potential xss attack (unrealistic, but still a security flaw).
parent cb192557
......@@ -11,12 +11,16 @@
})
.onStateChange(function () {
var gadget = this,
header_text = "By <strong>" + gadget.state.author +
"</strong> on " + gadget.state.modification_date + ":",
header_text_element = domsugar('p', [
'By ',
domsugar('strong', {text: gadget.state.author}),
' on ',
gadget.state.modification_date,
':']),
header = domsugar("div", {
class: "slapos-event-discussion-message-header"
}, [
domsugar('p', {html: header_text})
header_text_element
]);
if (gadget.state.content_type === 'text/html') {
return domsugar(gadget.element, {}, [
......
......@@ -236,7 +236,7 @@
</item>
<item>
<key> <string>serial</string> </key>
<value> <string>1001.26171.19762.42854</string> </value>
<value> <string>1002.9606.37397.136</string> </value>
</item>
<item>
<key> <string>state</string> </key>
......@@ -254,7 +254,7 @@
</tuple>
<state>
<tuple>
<float>1659986314.17</float>
<float>1660875500.26</float>
<string>UTC</string>
</tuple>
</state>
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment