SECURITY: Escape email text for posts containing [details].

2019-06-26 16:27:56 +03:00 · 2019-06-26 16:27:56 +03:00 · bccd090ced
parent 56b76f31dc
commit bccd090ced
1 changed files with 1 additions and 1 deletions
--- a/plugins/discourse-details/plugin.rb
+++ b/plugins/discourse-details/plugin.rb
@ -37,7 +37,7 @@ after_initialize do
      link = fragment.document.create_element("a")
      link["href"] = post.url if post
      link.content = I18n.t("details.excerpt_details")
-      el.replace text + " " + link.to_html
+      el.replace CGI.escapeHTML(text) + " " + link.to_html
    end
  end