mirror of
https://github.com/ankitects/anki.git
synced 2025-09-21 23:42:23 -04:00
82f3778340
The editor already strips script tags from fields, but was allowing
through Javascript in things like onclick handlers. We block this now,
as the editor context has access to internal APIs that we don't want to
expose to untrusted third-party code.
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| components | ||
| domlib | ||
| generated | ||
| sass | ||
| sveltelib | ||
| tag-editor | ||
| tslib | ||