fix xss (#2060)

2020-10-26 11:35:31 +01:00
parent 7ae55c1980
commit 6db21d7b34
28 changed files with 157 additions and 91 deletions
--- a/templates/timesheet/export.html.twig
+++ b/templates/timesheet/export.html.twig
@@ -61,7 +61,7 @@
                        <td>
                            {% if entry.description is not empty %}
                                <div>
-                                    {{ entry.description|escape|desc2html }}
+                                    {{ entry.description|desc2html }}
                                </div>
                            {% endif %}
                            <span class="small">
--- a/templates/timesheet/layout-listing.html.twig
+++ b/templates/timesheet/layout-listing.html.twig
@@ -144,7 +144,7 @@
                </td>
                <td class="{{ tables.data_table_column_class(tableName, columns, 'description') }} timesheet-description">
                    {% if allowMarkdown %}
-                        {{ entry.description|escape|desc2html }}
+                        {{ entry.description|desc2html }}
                    {% else %}
                        {{ entry.description|nl2br }}
                    {% endif %}