dracidoupe / graveyard

Open Source reimplementation of https://www.dracidoupe.cz/
https://nove.dracidoupe.cz/
MIT License
6 stars 4 forks source link

Fix XSS in the new version #320

Closed Almad closed 3 years ago

Almad commented 3 years ago

New version is vulnerable to XSS as it relies on escaping that is turned off because of old versions.

Temporarily revert to an escaped version compatible with the old version. Proper multi-format description formats are to be done once old version is shut down.

Almad commented 3 years ago

Follow-up in #322