pkp/pkp-lib#9421 replace v-html with v-strip-unsave-html

pkp · Feb 9, 2024 · f988258 · f988258
1 parent 999cb80
commit f988258
Show file tree

Hide file tree

Showing 6 changed files with 16 additions and 3 deletions.
diff --git a/.gitignore b/.gitignore
@@ -6,6 +6,7 @@ temp
 /plugins/paymethod/paypal/vendor/
 .project
 .project/
+.vscode
 .buildpath
 .settings/
 .htaccess

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -15,6 +15,7 @@
     "chart.js": "^2.9.4",
     "clone-deep": "^4.0.1",
     "debounce": "^1.2.0",
+    "dompurify": "^3.0.8",
     "element-resize-event": "^3.0.3",
     "moment": "^2.29.2",
     "tinymce": "^5.10.0",

diff --git a/plugins/importexport/native/templates/index.tpl b/plugins/importexport/native/templates/index.tpl
@@ -87,7 +87,7 @@
 								/>
 								<span
                                     class="listPanel__itemSubTitle"
-                                    v-html="localize(
+                                    v-strip-unsave-html="localize(
                                         item.publications.find(p => p.id == item.currentPublicationId).fullTitle,
                                         item.publications.find(p => p.id == item.currentPublicationId).locale
                                     )"

diff --git a/plugins/importexport/onix30/templates/index.tpl b/plugins/importexport/onix30/templates/index.tpl
@@ -59,7 +59,7 @@
 											/>
 											<span 
                                                 class="listPanel__itemSubTitle"
-                                                v-html="localize(
+                                                v-strip-unsave-html="localize(
                                                             item.publications.find(p => p.id == item.currentPublicationId).fullTitle,
                                                             item.publications.find(p => p.id == item.currentPublicationId).locale
                                                         )"

diff --git a/plugins/pubIds/urn/js/FieldTextUrn.js b/plugins/pubIds/urn/js/FieldTextUrn.js
@@ -22,7 +22,7 @@ var template = pkp.Vue.compile('<div class="pkpFormField pkpFormField--text pkpF
 '			<div' +
 '				v-if="isPrimaryLocale && description"' +
 '				class="pkpFormField__description"' +
-'				v-html="description"' +
+'				v-strip-unsave-html="description"' +
 '				:id="describedByDescriptionId"' +
 '			/>' +
 '			<div class="pkpFormField__control" :class="controlClasses">' +