frodovdr/node-red
1
0
Fork 0
mirror of https://github.com/node-red/node-red.git synced 2023-10-10 13:36:53 +02:00
Code Issues Releases Wiki Activity

Ensure any html in changelog is escaped before displaying

Browse Source
This commit is contained in:
Nick O'Leary 2021-06-29 13:58:24 +01:00
parent 977dfe700b
commit fa4b7a1a69
No known key found for this signature in database
GPG Key ID: 4F2157149161A6C9
2 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
CHANGELOG.md
View File

@ -45,7 +45,7 @@ Editor
- Update Node-RED Function typings in Monaco (#3008) @Steve-Mcl - Update Node-RED Function typings in Monaco (#3008) @Steve-Mcl
- Add css named variables for certain key colours (#2994) @knolleary - Add css named variables for certain key colours (#2994) @knolleary
- Improve contrast of export dialog JSON font color - Improve contrast of export dialog JSON font color
- Switch editableList buttons from \<a\> to \<button\> elements - Switch editableList buttons from <a> to <button> elements
- Add option to RED.nodes.createCompleteNodeSet to include node dimensions - Add option to RED.nodes.createCompleteNodeSet to include node dimensions
- Fix css of node help table of contents elements - Fix css of node help table of contents elements
- Improve red-ui-node-icon css and add red-ui-node-icon-small modifier class - Improve red-ui-node-icon css and add red-ui-node-icon-small modifier class

2
packages/node_modules/@node-red/editor-client/src/js/red.js vendored
View File

@ -540,6 +540,8 @@ var RED = (function() {
function showAbout() { function showAbout() {
$.get('red/about', function(data) { $.get('red/about', function(data) {
// data will be strictly markdown. Any HTML should be escaped.
data = RED.utils.sanitize(data);
var aboutHeader = '<div style="text-align:center;">'+ var aboutHeader = '<div style="text-align:center;">'+
'<img width="50px" src="red/images/node-red-icon.svg" />'+ '<img width="50px" src="red/images/node-red-icon.svg" />'+
'</div>'; '</div>';