github-mirror/discourse
github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-02-21 13:17:13 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

XSS: Escape the custom title (admin only) when displaying group titles.

Browse Source
This commit is contained in:
Robin Ward 2014-07-02 19:55:27 -04:00
parent 162b5abae6
commit 554e5c8482
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
app/assets/javascripts/discourse/components/poster-name.js.es6
View File

@ -37,6 +37,7 @@ var PosterNameComponent = Em.Component.extend({
var title = post.get('user_title');
if (!Em.isEmpty(title)) {
title = Handlebars.Utils.escapeExpression(title);
buffer.push('<span class="user-title">');
if (Em.isEmpty(primaryGroupName)) {
buffer.push(title);