nobigtech
/
fedilove
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Make sure every text in template is escaped by default (unless customCback returns unescaped value)

This commit is contained in:
Niko 2022-02-14 02:36:55 +01:00
parent 6f786583a9
commit adff18f54d
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
web/src/app/js/app.js
View File

@ -33,8 +33,9 @@ app.template = {
for (var i = 0; i < matches.length; i++) {
const k = matches[i];
if (k.match(/^[a-zA-Z0-9_\.]+$/)) {
var v = eval(`data.${k}`);
if (customCback !== undefined) {
var v = htmlescape(eval(`data.${k}`));
if (v !== undefined &&
customCback !== undefined) {
var newv = customCback(k, v);
if (newv !== undefined)
v = newv;