Penar Musaraj 0ab3ba5f0d
SECURITY: strip xlink:href from uploaded SVGs (#21057)
This was inadvertently removed in 4c46c7e. In very specific scenarios,
this could be used execute arbitrary JavaScript.

Only affects instances where SVGs are allowed as uploads and CDN is not
configured.
2023-04-11 14:10:44 -04:00
..
2022-04-28 11:51:03 +02:00
2023-02-21 10:30:48 +01:00
2023-02-21 10:30:48 +01:00
2023-02-21 10:30:48 +01:00
2023-02-21 10:30:48 +01:00
2023-02-21 10:30:48 +01:00