ahtlon/deck
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Merge pull request #509 from nextcloud/bugfix/504/fix-inline-javascript-error

Browse Source 
Do not prefix href of select2 with unsafe to avoid #504
This commit is contained in:
Julius Härtl
2018-06-28 21:31:38 +02:00
committed by GitHub
parent 34d05f2ac0 dc5fbbf7eb
commit db619e4cda
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
js/app/Config.js
View File

@@ -33,6 +33,9 @@ app.config(function ($provide, $interpolateProvider, $httpProvider, $urlRouterPr
$compileProvider.debugInfoEnabled(true); $compileProvider.debugInfoEnabled(true);
// This should fix adding "unsafe:" prefix to ui-select href links containing javascript
// inline JS is blocked by CSP anyway and filtered out by our markdown renderer as well
$compileProvider.aHrefSanitizationWhitelist(/^\s*(https?|javascript):/);
markdownItConverterProvider.use(markdownitLinkTarget, { markdownItConverterProvider.use(markdownitLinkTarget, {
breaks: true, breaks: true,