Skip to content

Commit

Permalink
Fix #136 remove html escape from the text widget
Browse files Browse the repository at this point in the history
Issue #126 incorrectly stated that the text widget was susceptible to HTML injection,
re-testing on version v1.1.9 confirmed it to not be the case. 

Saving/Re-saving HTML escaped content of the editable div caused further deterioration of the input as it gets re-escaped again and stored modified.
  • Loading branch information
mulander committed Feb 9, 2018
1 parent c8efb27 commit 33663f8
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion arc/js/entries/text.js
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ TextEntry.prototype.Render = function(with_value){
'data-entry-type="' + this.type + '" ' +
'class="div-editable" ' +
'id="' + this.id + '" ' +
'contenteditable="true">'+this.safeValue()+"</div>"
'contenteditable="true">'+this.value+"</div>"
);
}

Expand Down

0 comments on commit 33663f8

Please sign in to comment.