Discourse/DiscoTOC
1
0
Fork 0
mirror of https://github.com/discourse/DiscoTOC.git synced 2026-09-16 23:42:13 -04:00
Code Issues Packages Projects Releases Wiki Activity

SECURITY: Render TOC items as plain text (#44)

Browse Source
This commit is contained in:
Jarek Radosz
2022-10-03 21:10:05 +02:00
committed by GitHub
parent d6b02afbc2
commit f80c215a28
4 changed files with 33 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
javascripts/discourse/initializers/disco-toc-main.js
+3 -3
View File
@@ -286,9 +286,9 @@ export default {
li.classList.add("d-toc-item");
li.classList.add(`d-toc-${clonedNode.tagName.toLowerCase()}`);
li.innerHTML = `<a href="#" data-d-toc="${clonedNode.getAttribute("id")}">${
clonedNode.textContent
}</a>`;
const id = clonedNode.getAttribute("id");
li.innerHTML = `<a href="#" data-d-toc="${id}"></a>`;
li.querySelector("a").innerText = clonedNode.textContent.trim();
clonedNode.remove();
return li;