upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-06-09 08:44:07 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

fix(core): Do not use v-html for translation output

Browse source 
The content that can be renderered does *not* include HTML (see
`recommended` object).
But `v-html` was used, this is potentially dangerous, even though we
sanitize the translation values, so no urgent harm but better safe than
sorry.

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
This commit is contained in:
Ferdinand Thiessen 2024-11-18 14:31:05 +01:00 committed by nextcloud-command
parent fb75e2de78
commit 52769a47ed
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
core/src/components/setup/RecommendedApps.vue
View file

@ -18,7 +18,7 @@
<img :src="customIcon(app.id)" alt="">
<div class="info">
<h3>{{ customName(app) }}</h3>
<p v-html="customDescription(app.id)" />
<p v-text="customDescription(app.id)" />
<p v-if="app.installationError">
<strong>{{ t('core', 'App download or installation failed') }}</strong>
</p>