You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
…escaping everything
I took a wild stab at this - the options for the cleaner may need to be tweaked further, but this seems like a reasonable first attempt.
Discovered this while working on the new RTE, which writes slightly more advanced (and supported) HTML into posts than the old RTE does:
We fully escape all of the content here via
LJ::ehtml()
:https://github.com/dreamwidth/dw-free/blob/master/htdocs/editjournal.bml#L105-L107
Maybe we should instead strip all tags and just show any textual content, unless that's an empty string, in which case, show the escaped HTML instead.
This is lowish priority, but something should be done before RTE 2.0 comes out of beta...suggestions welcome.
The text was updated successfully, but these errors were encountered: