Erik Michelson dd40a6c04b fix(auth): sanitize email addresses ...

Previously, maliciously crafted email addresses
could be used to sneak HTML code into the HedgeDoc
editor, since HedgeDoc uses the local part of the
address as a display name for users.
We're now sanitizing this using DOMPurify.

Co-authored-by: Philip Molares <philip.molares@udo.edu>
Signed-off-by: Erik Michelson <github@erik.michelson.eu>

2026-06-18 23:56:45 +02:00

..

hedgedoc

feat: option to disable note creation

2024-07-21 11:03:35 +02:00

includes

Do not translate slogan

2023-07-30 20:07:27 +02:00

index

feat: option to disable note creation

2024-07-21 11:03:35 +02:00

shared

Allow SAML authentication provider to be named

2022-03-20 19:59:53 +01:00

error.ejs

Switch to ejs 3 compliant imports

2021-02-09 20:27:39 +01:00

hedgedoc.ejs

Templates: Remove lang and add translation parameter

2021-03-16 10:48:44 +01:00

htmlexport.ejs

Inline CSS & JS into HTML export template

2021-08-15 00:09:53 +02:00

index.ejs

Templates: Remove lang and add translation parameter

2021-03-16 10:48:44 +01:00

link.ejs

feat(editor): add external link warning page

2026-06-10 20:15:09 +02:00

pretty.ejs

fix(auth): sanitize email addresses

2026-06-18 23:56:45 +02:00

slide.ejs

Remove cdn support

2021-08-15 00:09:53 +02:00