fix(front): fix XSS because of bad operations when setting the group's summary
Group summary (HTML) is properly sanitized by the backend, but for groups we did a special operation before setting the HTML in the Vue app. This is now removed Signed-off-by: Thomas Citharel <tcit@tcit.fr>
This commit is contained in:
@@ -40,7 +40,7 @@
|
||||
<div
|
||||
class="mb-2 line-clamp-3"
|
||||
dir="auto"
|
||||
v-html="saneSummary"
|
||||
v-html="group.summary"
|
||||
v-if="showSummary"
|
||||
/>
|
||||
<div>
|
||||
@@ -91,7 +91,6 @@ import { addressFullName } from "@/types/address.model";
|
||||
import { useI18n } from "vue-i18n";
|
||||
import AccountGroup from "vue-material-design-icons/AccountGroup.vue";
|
||||
import Account from "vue-material-design-icons/Account.vue";
|
||||
import { htmlToText } from "@/utils/html";
|
||||
import { computed } from "vue";
|
||||
import LinkOrRouterLink from "../core/LinkOrRouterLink.vue";
|
||||
|
||||
@@ -108,8 +107,6 @@ const props = withDefaults(
|
||||
|
||||
const { t } = useI18n({ useScope: "global" });
|
||||
|
||||
const saneSummary = computed(() => htmlToText(props.group.summary ?? ""));
|
||||
|
||||
const isInternal = computed(() => {
|
||||
return props.isRemoteGroup && props.isLoggedIn === false;
|
||||
});
|
||||
|
||||
@@ -60,9 +60,9 @@
|
||||
</div>
|
||||
</div>
|
||||
<div
|
||||
class="mt-3 prose dark:prose-invert lg:prose-xl line-clamp-2"
|
||||
class="mt-3 prose dark:prose-invert lg:prose-xl prose-p:m-0 line-clamp-2"
|
||||
v-if="member.parent.summary"
|
||||
v-html="htmlToText(member.parent.summary)"
|
||||
v-html="member.parent.summary"
|
||||
/>
|
||||
</div>
|
||||
<div>
|
||||
@@ -95,7 +95,6 @@ import DotsHorizontal from "vue-material-design-icons/DotsHorizontal.vue";
|
||||
import AccountGroup from "vue-material-design-icons/AccountGroup.vue";
|
||||
import AccountCircle from "vue-material-design-icons/AccountCircle.vue";
|
||||
import Tag from "@/components/TagElement.vue";
|
||||
import { htmlToText } from "@/utils/html";
|
||||
import { useI18n } from "vue-i18n";
|
||||
|
||||
defineProps<{
|
||||
|
||||
Reference in New Issue
Block a user