overleaf/services/web/public/coffee/main/system-messages.coffee

define [
	"base"
], (App) ->
	App.controller "SystemMessagesController", ($scope) ->
		$scope.messages = window.systemMessages;
		
	App.controller "SystemMessageController", ($scope, $sce) ->
		$scope.hidden = $.localStorage("systemMessage.hide.#{$scope.message._id}")
		$scope.htmlContent = $scope.message.content
		
		$scope.hide = () ->
			$scope.hidden = true
			$.localStorage("systemMessage.hide.#{$scope.message._id}", true)
Add in system messages 2014-07-24 08:24:08 -04:00			`define [`
			`"base"`
			`], (App) ->`
			`App.controller "SystemMessagesController", ($scope) ->`
			`$scope.messages = window.systemMessages;`

			`App.controller "SystemMessageController", ($scope, $sce) ->`
			`$scope.hidden = $.localStorage("systemMessage.hide.#{$scope.message._id}")`
Sanitize display of system messages. When showing system-messages, use default Angular sanitizer, also, on the admin panel itself, show the verbatim text of the message. This solves a mild Stored-XSS vulnerability whereby a user could put `<script>` tags in a message. We don't want that, but we do want to be able to use basic html tags. 2018-08-22 05:15:50 -04:00			`$scope.htmlContent = $scope.message.content`
Add in system messages 2014-07-24 08:24:08 -04:00
			`$scope.hide = () ->`
			`$scope.hidden = true`
Sanitize display of system messages. When showing system-messages, use default Angular sanitizer, also, on the admin panel itself, show the verbatim text of the message. This solves a mild Stored-XSS vulnerability whereby a user could put `<script>` tags in a message. We don't want that, but we do want to be able to use basic html tags. 2018-08-22 05:15:50 -04:00			`$.localStorage("systemMessage.hide.#{$scope.message._id}", true)`