github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-22 22:01:14 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: prevents XSS in local-dates

Browse Source
This commit is contained in:
Joffrey JAFFEUX
2018-08-27 11:19:30 +02:00
committed by GitHub
parent cf3b7ccae2
commit 89e7d95cc7
2 changed files with 18 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
plugins/discourse-local-dates/assets/javascripts/discourse-local-dates.js
View File

@ -46,10 +46,7 @@
var html = "<span>"; var html = "<span>";
html += "<i class='fa fa-globe d-icon d-icon-globe'></i>"; html += "<i class='fa fa-globe d-icon d-icon-globe'></i>";
html += relativeTime.replace( html += "<span class='relative-time'></span>";
"TZ",
_formatTimezone(moment.tz.guess()).join(": ")
);
html += "</span>"; html += "</span>";
var joinedPreviews = previews.join(" – "); var joinedPreviews = previews.join(" – ");
@ -58,7 +55,14 @@
.html(html) .html(html)
.attr("title", joinedPreviews) .attr("title", joinedPreviews)
.attr("data-tooltip", joinedPreviews) .attr("data-tooltip", joinedPreviews)
.addClass("cooked"); .addClass("cooked")
.find(".relative-time")
.text(
relativeTime.replace(
"TZ",
_formatTimezone(moment.tz.guess()).join(": ")
)
);
if (repeat) { if (repeat) {
this.timeout = setTimeout(function() { this.timeout = setTimeout(function() {

14
plugins/discourse-local-dates/assets/javascripts/lib/discourse-markdown/discourse-local-dates.js.es6
View File

@ -25,13 +25,17 @@ function addLocalDate(buffer, matches, state) {
token = new state.Token("span_open", "span", 1); token = new state.Token("span_open", "span", 1);
token.attrs = [ token.attrs = [
["class", "discourse-local-date"], ["class", "discourse-local-date"],
["data-date", config.date], ["data-date", state.md.utils.escapeHtml(config.date)],
["data-time", config.time], ["data-time", state.md.utils.escapeHtml(config.time)],
["data-format", config.format], ["data-format", state.md.utils.escapeHtml(config.format)],
["data-timezones", config.timezones] ["data-timezones", state.md.utils.escapeHtml(config.timezones)]
]; ];
if (config.recurring) { if (config.recurring) {
token.attrs.push(["data-recurring", config.recurring]); token.attrs.push([
"data-recurring",
state.md.utils.escapeHtml(config.recurring)
]);
} }
buffer.push(token); buffer.push(token);