-
-
Notifications
You must be signed in to change notification settings - Fork 4.5k
Description
Platform: RaspberryPi 3 with Debian 10 Buster
Node Version: 16.14.2
MagicMirror Version: 2.18.0
Description: I wanted to show an alert with a HTML code message. The problem occurs also with notifications.
Steps to Reproduce: Show alert or notification with custom HTML code in the message.
Expected Results: The HTML code in the message should be parsed and the message should be displayed accordingly to the specified HTML code.
Actual Results: The complete message (HTML code and actual message) is escaped and the code and message in the alert popup is displayed as plain text.
Additional Notes: When you set the option autoescape: false in the file js/module.js where the nunjucks environment is created, everything works as expected and the message won't be escaped and is displayed correctly according to the provided HTML code.
But maybe there is another way to get the HTML code in alerts working again because if autoescape is deactivated this could be a security risk because code injection is possible then.