Use HTML sanatizer to harden HTML rendering on log_details page

Should be more safe than use |raw directly and for these smalls things performance hit is zero.
This commit is contained in:
Jan Böhmer 2026-06-10 23:43:07 +02:00
parent b357ee196c
commit 8421636b1c
4 changed files with 80 additions and 5 deletions

View file

@ -58,7 +58,7 @@
</tr>
<tr>
<td>{% trans %}log.target{% endtrans %}</td>
<td>{{ target_html|raw }}</td>
<td>{{ target_html|sanitize_html }}</td>
</tr>
</table>
@ -111,7 +111,7 @@
{% elseif log_entry is instanceof('App\\Entity\\LogSystem\\CollectionElementDeleted') %}
{% include "log_system/details/_extra_collection_element_deleted.html.twig" %}
{% else %}
{{ extra_html | raw }}
{{ extra_html | sanitize_html }}
{% endif %}
</div>
{% endblock %}
{% endblock %}