From 9799a24a27f72d9bdab0810adb3e36846d886f61 Mon Sep 17 00:00:00 2001 From: Juanfran Date: Wed, 22 Jul 2015 14:56:36 +0200 Subject: [PATCH] [backport] fix issue #3094 - angular code xss in comments --- app/partials/common/history/history-activity.jade | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/partials/common/history/history-activity.jade b/app/partials/common/history/history-activity.jade index 89ed64fd..d9c225ca 100644 --- a/app/partials/common/history/history-activity.jade +++ b/app/partials/common/history/history-activity.jade @@ -15,7 +15,7 @@ div(class!="activity-single <%- mode %>") span(translate="COMMENTS.DELETED_INFO", translate-values!="{ user: '<%- deleteCommentUser %>', date: '<%- deleteCommentDate %>'}") <% } %> - .comment.wysiwyg + .comment.wysiwyg(ng-non-bindable) | <%= comment %> <% if (!deleteCommentDate && mode !== "activity" && canDeleteComment) { %> a(href="", class="icon icon-delete comment-delete", data-activity-id!="<%- activityId %>")