IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-02-25 18:55:32 -06:00
Code Issues Packages Projects Releases Wiki Activity

SECURITY: Correctly escape 'text' email preview

Browse Source
This commit is contained in:
David Taylor
2023-09-27 11:58:18 +01:00
committed by Penar Musaraj
parent 76bdea5ce2
commit 0ed20fe1cd
2 changed files with 46 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
app/assets/javascripts/admin/addon/templates/email-preview-digest.hbs
View File

@@ -21,13 +21,15 @@
{{#if this.showHtml}}
<span>{{i18n "admin.email.html"}}</span>
|
<a href {{on "click" this.toggleShowHtml}}>
<a href {{on "click" this.toggleShowHtml}} class="show-text-link">
{{i18n "admin.email.text"}}
</a>
{{else}}
<a href {{on "click" this.toggleShowHtml}}>{{i18n
"admin.email.html"
}}</a>
<a
href
{{on "click" this.toggleShowHtml}}
class="show-html-link"
>{{i18n "admin.email.html"}}</a>
|
<span>{{i18n "admin.email.text"}}</span>
{{/if}}
@@ -77,7 +79,7 @@
></iframe>
{{/if}}
{{else}}
<pre>{{html-safe this.model.text_content}}</pre>
<pre>{{this.model.text_content}}</pre>
{{/if}}
</div>
</div>