Skip to content

Commit 12a1fc8

Browse files
authored
Merge commit from fork
fix: replace HtmlEditor with plain TextEditor to avoid XSS injection
2 parents 80efb38 + 42d4ecf commit 12a1fc8

1 file changed

Lines changed: 8 additions & 5 deletions

File tree

  • src/WebAppDIRAC/WebApp/static/DIRAC/Notepad/classes

src/WebAppDIRAC/WebApp/static/DIRAC/Notepad/classes/Notepad.js

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
Ext.define("DIRAC.Notepad.classes.Notepad", {
77
extend: "Ext.dirac.core.Module",
88

9-
requires: ["Ext.form.field.HtmlEditor"],
9+
requires: ["Ext.form.field.TextArea"],
1010

1111
initComponent: function () {
1212
var me = this;
@@ -16,8 +16,11 @@ Ext.define("DIRAC.Notepad.classes.Notepad", {
1616
me.launcher.width = 400;
1717
me.launcher.height = 400;
1818

19-
me.editor = new Ext.form.field.HtmlEditor({
20-
value: ['Some <b>rich</b> <font color="red">text</font> goes <u>here</u><br>', "Give it a try!"].join(""),
19+
me.editor = new Ext.form.field.TextArea({
20+
value: ["Some text goes here.", "Give it a try!"].join("\n"),
21+
grow: true,
22+
growMin: 200,
23+
enableKeyEvents: true,
2124
});
2225

2326
Ext.apply(me, {
@@ -32,10 +35,10 @@ Ext.define("DIRAC.Notepad.classes.Notepad", {
3235
var me = this;
3336

3437
if ("helptext" in data) {
35-
me.editor.setValue(data["helptext"]);
38+
me.editor.setValue(String(data["helptext"] || ""));
3639
}
3740
if ("text" in data) {
38-
me.editor.setValue(data["text"]);
41+
me.editor.setValue(String(data["text"] || ""));
3942
}
4043
},
4144

0 commit comments

Comments
 (0)