mirror of
https://github.com/Part-DB/Part-DB-server.git
synced 2026-06-19 09:01:33 +00:00
Use HTML sanatizer to harden HTML rendering on log_details page
Should be more safe than use |raw directly and for these smalls things performance hit is zero.
This commit is contained in:
parent
b357ee196c
commit
8421636b1c
4 changed files with 80 additions and 5 deletions
|
|
@ -58,7 +58,7 @@
|
|||
</tr>
|
||||
<tr>
|
||||
<td>{% trans %}log.target{% endtrans %}</td>
|
||||
<td>{{ target_html|raw }}</td>
|
||||
<td>{{ target_html|sanitize_html }}</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
|
@ -111,7 +111,7 @@
|
|||
{% elseif log_entry is instanceof('App\\Entity\\LogSystem\\CollectionElementDeleted') %}
|
||||
{% include "log_system/details/_extra_collection_element_deleted.html.twig" %}
|
||||
{% else %}
|
||||
{{ extra_html | raw }}
|
||||
{{ extra_html | sanitize_html }}
|
||||
{% endif %}
|
||||
</div>
|
||||
{% endblock %}
|
||||
{% endblock %}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue