IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-02-25 18:55:32 -06:00
Code Issues Packages Projects Releases Wiki Activity

SECURITY: prevents XSS in local-dates

Browse Source
This commit is contained in:
Joffrey JAFFEUX 2018-08-27 11:19:30 +02:00 committed by GitHub
parent cf3b7ccae2
commit 89e7d95cc7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 18 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
plugins/discourse-local-dates/assets/javascripts/discourse-local-dates.js
View File

@ -46,10 +46,7 @@
var html = "<span>";
html += "<i class='fa fa-globe d-icon d-icon-globe'></i>";
html += relativeTime.replace(
"TZ",
_formatTimezone(moment.tz.guess()).join(": ")
);
html += "<span class='relative-time'></span>";
html += "</span>";
var joinedPreviews = previews.join(" – ");
@ -58,7 +55,14 @@
.html(html)
.attr("title", joinedPreviews)
.attr("data-tooltip", joinedPreviews)
.addClass("cooked");
.addClass("cooked")
.find(".relative-time")
.text(
relativeTime.replace(
"TZ",
_formatTimezone(moment.tz.guess()).join(": ")
)
);
if (repeat) {
this.timeout = setTimeout(function() {

14
plugins/discourse-local-dates/assets/javascripts/lib/discourse-markdown/discourse-local-dates.js.es6
View File

@ -25,13 +25,17 @@ function addLocalDate(buffer, matches, state) {
token = new state.Token("span_open", "span", 1);
token.attrs = [
["class", "discourse-local-date"],
["data-date", config.date],
["data-time", config.time],
["data-format", config.format],
["data-timezones", config.timezones]
["data-date", state.md.utils.escapeHtml(config.date)],
["data-time", state.md.utils.escapeHtml(config.time)],
["data-format", state.md.utils.escapeHtml(config.format)],
["data-timezones", state.md.utils.escapeHtml(config.timezones)]
];
if (config.recurring) {
token.attrs.push(["data-recurring", config.recurring]);
token.attrs.push([
"data-recurring",
state.md.utils.escapeHtml(config.recurring)
]);
}
buffer.push(token);