pk/atst
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

use v-text instead of v-html

Browse Source 
v-html interprets the string passed to it as raw html, without escaping.
We should use v-text wherever possible.
This commit is contained in:
graham-dds
2020-01-14 15:16:21 -05:00
parent d55a81ebdd
commit ffd3dd2d9d
4 changed files with 13 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
templates/components/clin_fields.html
View File

@@ -23,7 +23,7 @@
inline-template>
<div class="clin-card" v-if="showClin">
<div class="card__title">
<span class="h4" v-html='clinTitle'></span>
<span class="h4" v-text='clinTitle'></span>
<button
v-if='clinIndex > 0'
class="icon-link icon-link__remove-clin"
@@ -119,7 +119,7 @@
{% endif %}
<div class="h5 clin-card__title">Percent Obligated</div>
<p id="percent-obligated" v-html='percentObligated'></p>
<p id="percent-obligated" v-text='percentObligated'></p>
<hr>
<div class="form-row">
@@ -140,7 +140,7 @@
<div class='modal__dialog' role='dialog' aria-modal='true'>
<div class='modal__body'>
<div class="task-order__modal-cancel">
<h1 v-html='"{{ 'task_orders.form.clin_remove_text' | translate }}" + clinTitle + "?"'></h1>
<h1 v-text='"{{ 'task_orders.form.clin_remove_text' | translate }}" + clinTitle + "?"'></h1>
<div class="task-order__modal-cancel_buttons">
<button
v-on:click='closeModal(removeModalId)'