mirror of
https://github.com/discourse/discourse.git
synced 2024-11-25 19:53:37 +08:00
5ee31cbf7d
* FIX: Mark invites flash messages as HTML safe. This change should be safe as all user inputs included in the errors are sanitized before sending it back to the client. Context: https://meta.discourse.org/t/html-tags-are-explicit-after-latest-update/214220 * If somebody adds a new error message that includes user input and doesn't sanitize it, using html-safe suddenly becomes unsafe again. As an extra layer of protection, we make the client sanitize the error message received from the backend. * Escape user input instead of sanitizing |
||
|---|---|---|
| .. | ||
| admin | ||
| confirm-new-email | ||
| discourse | ||
| discourse-common | ||
| discourse-hbr | ||
| discourse-widget-hbs | ||
| docs | ||
| ember-addons | ||
| locales | ||
| pretty-text | ||
| select-kit | ||
| truth-helpers | ||
| wizard | ||
| .npmrc | ||
| activate-account.js | ||
| admin.js.erb | ||
| app-boot.js | ||
| application.js | ||
| auto-redirect.js | ||
| browser-detect.js | ||
| browser-update.js | ||
| discourse-loader.js | ||
| discourse-shims.js | ||
| embed-application.js | ||
| ember_include.js.erb | ||
| ember_jquery.js | ||
| env.js | ||
| google-tag-manager.js | ||
| google-universal-analytics-v3.js | ||
| google-universal-analytics-v4.js | ||
| handlebars-shim.js | ||
| main_include_admin.js | ||
| markdown-it-bundle.js | ||
| onpopstate-handler.js | ||
| package.json | ||
| polyfills.js | ||
| pretty-text-bundle.js | ||
| print-page.js | ||
| service-worker.js.erb | ||
| set-prototype-polyfill.js | ||
| start-discourse.js | ||
| template_include.js | ||
| test-shims.js | ||
| vendor-common.js | ||
| vendor-theme-tests.js | ||
| vendor.js | ||
| widget-runtime.js | ||
| wizard-application.js | ||
| wizard-shims.js | ||
| wizard-start.js | ||
| wizard-vendor.js | ||
| yarn.lock | ||