mirror of
https://github.com/hedgedoc/hedgedoc.git
synced 2024-12-01 13:21:06 -05:00
f552b14e11
HedgeDoc displays the username and user photo at various places by rendering the respective variables into an `ejs` template. As the values are user-provided or generated from user-provided data, it may be possible to inject unwanted HTML. This commit sanitizes the username and photo URL by passing them through the `xss` library. Co-authored-by: Christoph (Sheogorath) Kern <sheogorath@shivering-isles.com> Signed-off-by: David Mehren <git@herrmehren.de> |
||
|---|---|---|
| .. | ||
| author.js | ||
| index.js | ||
| note.js | ||
| revision.js | ||
| temp.js | ||
| user.js | ||