Commit 813a17a1 authored by Rafael Monnerat's avatar Rafael Monnerat

slapos_jio: Dont use domsugar raw html

   This can lead to potential xss attack (unrealistic, but still a security flaw).
parent cb192557
...@@ -11,12 +11,16 @@ ...@@ -11,12 +11,16 @@
}) })
.onStateChange(function () { .onStateChange(function () {
var gadget = this, var gadget = this,
header_text = "By <strong>" + gadget.state.author + header_text_element = domsugar('p', [
"</strong> on " + gadget.state.modification_date + ":", 'By ',
domsugar('strong', {text: gadget.state.author}),
' on ',
gadget.state.modification_date,
':']),
header = domsugar("div", { header = domsugar("div", {
class: "slapos-event-discussion-message-header" class: "slapos-event-discussion-message-header"
}, [ }, [
domsugar('p', {html: header_text}) header_text_element
]); ]);
if (gadget.state.content_type === 'text/html') { if (gadget.state.content_type === 'text/html') {
return domsugar(gadget.element, {}, [ return domsugar(gadget.element, {}, [
......
...@@ -236,7 +236,7 @@ ...@@ -236,7 +236,7 @@
</item> </item>
<item> <item>
<key> <string>serial</string> </key> <key> <string>serial</string> </key>
<value> <string>1001.26171.19762.42854</string> </value> <value> <string>1002.9606.37397.136</string> </value>
</item> </item>
<item> <item>
<key> <string>state</string> </key> <key> <string>state</string> </key>
...@@ -254,7 +254,7 @@ ...@@ -254,7 +254,7 @@
</tuple> </tuple>
<state> <state>
<tuple> <tuple>
<float>1659986314.17</float> <float>1660875500.26</float>
<string>UTC</string> <string>UTC</string>
</tuple> </tuple>
</state> </state>
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment