Maniphest T182852

Escape HTML when rendering cat17 comment list
Closed, ResolvedPublic
Actions

Assigned To

None

Authored By

	• Pablo-WMDE
	Dec 14 2017, 8:37 AM

Tags

Referenced Files

None

Subscribers

Description

https://github.com/wmde/FundraisingFrontend/blob/master/skins/cat17/src/scripts/donationComments.js#L57 is a little too trusting (donor name, comment text, ...). Easy(er) to demo after T180344 merge.

Related Objects

Mentioned Here: T180344: Comment donation - Integrate layout

Event Timeline

• Pablo-WMDE created this task.Dec 14 2017, 8:37 AM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptDec 14 2017, 8:37 AM

• Pablo-WMDE updated the task description. (Show Details)Dec 14 2017, 8:57 AM

• Pablo-WMDE moved this task from Backlog to Ready on the WMDE-Fundraising-Funban-2 board.

• Pablo-WMDE claimed this task.Dec 14 2017, 9:36 AM

• Pablo-WMDE moved this task from Ready to Doing on the WMDE-Fundraising-Funban-2 board.

PR https://github.com/wmde/FundraisingFrontend/pull/1112

• Pablo-WMDE removed • Pablo-WMDE as the assignee of this task.Dec 14 2017, 10:03 AM

• Pablo-WMDE moved this task from Doing to Review on the WMDE-Fundraising-Funban-2 board.

Available on http://test-spenden-2.wikimedia.de/?skin=cat17

• Pablo-WMDE moved this task from Review to Test on the WMDE-Fundraising-Funban-2 board.Dec 15 2017, 10:12 AM

• Pablo-WMDE moved this task from Test to Done on the WMDE-Fundraising-Funban-2 board.Dec 18 2017, 9:15 AM

kai.nissen closed this task as Resolved.Jan 5 2018, 2:14 PM