github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2024-12-02 20:35:21 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: prevents XSS when showing tooltip

Browse Source
This commit is contained in:
Joffrey JAFFEUX 2018-06-27 14:35:47 +02:00
parent 6bcdc3ba4b
commit b5b847f6d6
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
app/assets/javascripts/discourse/lib/tooltip.js.es6
View File

@ -1,9 +1,11 @@
import { escapeExpression } from "discourse/lib/utilities";
export function showTooltip() { export function showTooltip() {
const fadeSpeed = 300; const fadeSpeed = 300;
const tooltipID = "#discourse-tooltip"; const tooltipID = "#discourse-tooltip";
const $this = $(this); const $this = $(this);
const $parent = $this.offsetParent(); const $parent = $this.offsetParent();
const content = $this.attr("data-tooltip"); const content = escapeExpression($this.attr("data-tooltip"));
const retina = const retina =
window.devicePixelRatio && window.devicePixelRatio > 1 window.devicePixelRatio && window.devicePixelRatio > 1
? "class='retina'" ? "class='retina'"