Discource-C
/
discourse
mirror of https://github.com/discourse/discourse.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

DEV: Don't interpret user field names as HTML (#18317) 

This isn't a security bug, because only admins can create user fields
and we have to trust admins, because they can change themes, which are
shown site-wide and can contain unrestricted JS.
This commit is contained in:
Daniel Waterworth 2022-09-21 12:21:58 -05:00 committed by GitHub
parent a11aea4fe2
commit e37ced96bf
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/assets/javascripts/discourse/app/templates/components/user-fields/confirm.hbs
View File

@ -1,6 +1,6 @@
{{#if this.field.name}} {{#if this.field.name}}
<label class="control-label"> <label class="control-label">
{{html-safe this.field.name}} {{#if this.field.required}}<span class="required">*</span>{{/if}} {{this.field.name}} {{#if this.field.required}}<span class="required">*</span>{{/if}}
</label> </label>
{{/if}} {{/if}}

2
app/assets/javascripts/discourse/app/templates/components/user-fields/dropdown.hbs
View File

@ -1,5 +1,5 @@
<label class="control-label" for={{concat "user-" this.elementId}}> <label class="control-label" for={{concat "user-" this.elementId}}>
{{html-safe this.field.name}} {{this.field.name}}
{{#if this.field.required}} {{#if this.field.required}}
<span class="required">*</span> <span class="required">*</span>
{{/if}} {{/if}}

2
app/assets/javascripts/discourse/app/templates/components/user-fields/multiselect.hbs
View File

@ -1,5 +1,5 @@
<label class="control-label" for={{concat "user-" this.elementId}}> <label class="control-label" for={{concat "user-" this.elementId}}>
{{html-safe this.field.name}} {{this.field.name}}
{{#if this.field.required}} {{#if this.field.required}}
<span class="required">*</span> <span class="required">*</span>
{{/if}} {{/if}}

2
app/assets/javascripts/discourse/app/templates/components/user-fields/text.hbs
View File

@ -1,5 +1,5 @@
<label class="control-label" for={{concat "user-" this.elementId}}> <label class="control-label" for={{concat "user-" this.elementId}}>
{{html-safe this.field.name}} {{this.field.name}}
{{#if this.field.required}}<span class="required">*</span>{{/if}} {{#if this.field.required}}<span class="required">*</span>{{/if}}
</label> </label>
<div class="controls"> <div class="controls">