Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-04 10:39:43 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-calendar/spec
History
Exact
Isaac Janzen 3298a9df91
 FIX: Sanitize calendar event tooltip HTML (#42215) 
## Summary

Correctly sanitize calendar event tooltip content through the Discourse
standard sanitizer immediately before the trustHTML sink, removing
unsafe attributes like `id` and `style` while preserving safe formatting
such as links, emoji, bold labels, and line breaks.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1578

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-31 10:28:47 -05:00
..
fabricators UX: More Zoom livestream UI issues (#41824) 2026-07-27 15:31:41 +10:00
fixtures/csv UX: Rework the event bulk invite modal (#40496) 2026-06-18 10:38:34 +02:00
integration FIX: Reset topic tracking when an attendee leaves an event (#40490) 2026-06-15 09:06:46 -03:00
jobs FEATURE: Embedded Zoom webinar for livestream events (#40973) 2026-07-16 10:58:56 +10:00
lib SECURITY: Remove stale invitee access for users removed from invited groups on private events (#42187) 2026-07-30 15:15:46 -05:00
migrations FIX: Cook event location and description as inline markdown (#41994) 2026-07-28 18:59:23 +02:00
models FEATURE: Embedded Zoom webinar for livestream events (#40973) 2026-07-16 10:58:56 +10:00
requests SECURITY: Remove stale invitee access for users removed from invited groups on private events (#42187) 2026-07-30 15:15:46 -05:00
serializers UX: hide timeline for livestream topics, make layout more reliable (#42209) 2026-07-31 10:16:52 -04:00
services FEATURE: Promote Ideas & Events category types to permanent status (#42080) 2026-07-29 09:20:40 +10:00
system FIX: Sanitize calendar event tooltip HTML (#42215) 2026-07-31 10:28:47 -05:00