github-mirror/discourse
github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-02-23 03:02:12 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: XSS Protection on Queued Posts

Browse Source
This commit is contained in:
Robin Ward 2015-11-20 14:13:00 -05:00
parent a324c71869
commit e9f80464b4
2 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/assets/javascripts/discourse/helpers/cook-text.js.es6
View File

@ -1,6 +1,6 @@
import registerUnbound from 'discourse/helpers/register-unbound';
registerUnbound('cook-text', function(text) {
return new Handlebars.SafeString(Discourse.Markdown.cook(text));
return new Handlebars.SafeString(Discourse.Markdown.cook(text, {sanitize: true}));
});

7
app/assets/javascripts/discourse/routes/queued-posts.js.es6
View File

@ -1,6 +1,13 @@
import loadScript from 'discourse/lib/load-script';
import DiscourseRoute from 'discourse/routes/discourse';
export default DiscourseRoute.extend({
// this route requires the sanitizer
beforeModel() {
loadScript('defer/html-sanitizer-bundle');
},
model() {
return this.store.find('queuedPost', {status: 'new'});
},