fix: xss on flags page via ban reason

2025-10-26 08:36:12 +01:00 · 2021-09-17 11:10:43 -04:00
parent 66eaae44a6
commit ba3582b873
1 changed files with 1 additions and 1 deletions
--- a/src/flags.js
+++ b/src/flags.js
@@ -794,7 +794,7 @@ async function mergeBanHistory(history, targetUid, uids) {
 			meta: [
 				{
 					key: '[[user:banned]]',
-					value: cur.reason,
+					value: validator.escape(String(cur.reason)),
 					labelClass: 'danger',
 				},
 				{