/echo html allowed sanitize title too

63c6fbaf589139c74e8a0d0aaada3c15c8236c89

Wolfsblvt <wolfsblvt@gmail.com>

Parents: 50a716a59327550ec99f22815e97497279a15c14
1 files changed, +2 -1Ignore whitespace
public/scripts/slash-commands.js+2 -1
@@ -2227,7 +2227,7 @@ async function echoCallback(args, value) {
2227 // Make sure that the value is a string2227 // Make sure that the value is a string
2228 value = String(value);2228 value = String(value);
22292229
2230 const title = args.title ? args.title : undefined;2230 let title = args.title ? args.title : undefined;
2231 const severity = args.severity ? args.severity : 'info';2231 const severity = args.severity ? args.severity : 'info';
22322232
2233 /** @type {ToastrOptions} */2233 /** @type {ToastrOptions} */
@@ -2259,6 +2259,7 @@ async function echoCallback(args, value) {
22592259
2260 // If we allow HTML, we need to sanitize it to prevent security risks2260 // If we allow HTML, we need to sanitize it to prevent security risks
2261 if (!options.escapeHtml) {2261 if (!options.escapeHtml) {
2262 if (title) title = DOMPurify.sanitize(title, { FORBID_TAGS: ['style'] });
2262 value = DOMPurify.sanitize(value, { FORBID_TAGS: ['style'] });2263 value = DOMPurify.sanitize(value, { FORBID_TAGS: ['style'] });
2263 }2264 }
22642265