From f4ee11611294c2cc957453768f768de0a51b05a7 Mon Sep 17 00:00:00 2001 From: Thomas Citharel Date: Thu, 14 Dec 2023 10:57:12 +0100 Subject: [PATCH] fix(front): escape event.title when it's passed to dialog component HTML message Signed-off-by: Thomas Citharel --- src/components/Event/EventParticipationCard.vue | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/components/Event/EventParticipationCard.vue b/src/components/Event/EventParticipationCard.vue index dfd470cb9..0b067e0f8 100644 --- a/src/components/Event/EventParticipationCard.vue +++ b/src/components/Event/EventParticipationCard.vue @@ -346,6 +346,7 @@ import { Dialog } from "@/plugins/dialog"; import { Snackbar } from "@/plugins/snackbar"; import { useDeleteEvent } from "@/composition/apollo/event"; import Tag from "@/components/TagElement.vue"; +import { escapeHtml } from "@/utils/html"; import Bullhorn from "vue-material-design-icons/Bullhorn.vue"; const props = defineProps<{ @@ -388,7 +389,7 @@ const openDeleteEventModal = ( )}

${t('To confirm, type your event title "{eventTitle}"', { - eventTitle: event.title, + eventTitle: escapeHtml(event.title), })}`, confirmText: t("Delete {eventTitle}", { eventTitle: event.title,