From 724ba8eb12cb0f5f0a0f095075d0a0f8f3a3d3d7 Mon Sep 17 00:00:00 2001 From: Ankit Kokane <97180942+thedudeontitan@users.noreply.github.com> Date: Sun, 29 Oct 2023 00:30:38 +0530 Subject: [PATCH 1/2] Removed Bootstrap class and migrated Navbar to Tailwind CSS (#1510) * Removed Bootstrap class and migrated Navbar to Tailwind CSS Signed-off-by: Ankit Kokane * Update website/templates/includes/navbar.html Co-authored-by: DonnieBLT <128622481+DonnieBLT@users.noreply.github.com> * Update website/templates/includes/navbar.html Co-authored-by: DonnieBLT <128622481+DonnieBLT@users.noreply.github.com> * added trans tags * Update navbar.html join the js blocks * Fixed failing django test --------- Signed-off-by: Ankit Kokane Co-authored-by: DonnieBLT <128622481+DonnieBLT@users.noreply.github.com> --- website/templates/includes/navbar.html | 233 +++++++++++-------------- 1 file changed, 101 insertions(+), 132 deletions(-) diff --git a/website/templates/includes/navbar.html b/website/templates/includes/navbar.html index 9500ddddb..27ccc0e90 100644 --- a/website/templates/includes/navbar.html +++ b/website/templates/includes/navbar.html @@ -6,17 +6,51 @@ {% load i18n %} {% load custom_tags %} + + + + From 69c065587867dea4d19d3fb11c77946ac807ffa8 Mon Sep 17 00:00:00 2001 From: Manthan Sharma <143496678+manthan-sharma-23@users.noreply.github.com> Date: Sun, 29 Oct 2023 02:43:06 +0530 Subject: [PATCH 2/2] sanitization of HTML element to avoid injection (#1518) --- website/static/vendor/bootstrap/js/bootstrap.js | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/website/static/vendor/bootstrap/js/bootstrap.js b/website/static/vendor/bootstrap/js/bootstrap.js index c46ec9682..edc381883 100644 --- a/website/static/vendor/bootstrap/js/bootstrap.js +++ b/website/static/vendor/bootstrap/js/bootstrap.js @@ -520,7 +520,14 @@ function sanitizeSelector(selector) { var clickHandler = function (e) { var href var $this = $(this) - var $target = $($this.attr('data-target') || (href = $this.attr('href')) && href.replace(/.*(?=#[^\s]+$)/, '')) // strip for ie7 + + // sanitizing the elements + var dataTarget = $this.attr('data-target'); + var href = $this.attr('href'); + var sanitizedDataTarget = escapeHTML(dataTarget); + var sanitizedHref = escapeHTML(href); + var $target = $(sanitizedDataTarget || sanitizedHref && sanitizedHref.replace(/.*(?=#[^\s]+$)/, '')); + if (!$target.hasClass('carousel')) return var options = $.extend({}, $target.data(), $this.data()) var slideIndex = $this.attr('data-slide-to')