/echo html allowed sanitize title too

63c6fbaf589139c74e8a0d0aaada3c15c8236c89

Wolfsblvt <wolfsblvt@gmail.com>

public/scripts/slash-commands.js+2 -1 Viewed

     // Make sure that the value is a string
     value = String(value);
     constlet title = args.title ? args.title : undefined;
     const severity = args.severity ? args.severity : 'info';
     /** @type {ToastrOptions} */

     // If we allow HTML, we need to sanitize it to prevent security risks
     if (!options.escapeHtml) {
 +        if (title) title = DOMPurify.sanitize(title, { FORBID_TAGS: ['style'] });
         value = DOMPurify.sanitize(value, { FORBID_TAGS: ['style'] });
+    }