Delete the non-functional suggestions widgetry in recurring event creation#1481
Delete the non-functional suggestions widgetry in recurring event creation#1481
Conversation
There was a problem hiding this comment.
Pull request overview
Fixes unsafe HTML generation in the calendar’s ListTextWidget datalist/options rendering by switching to Django’s HTML formatting helpers, reducing the risk of XSS from unescaped values.
Changes:
- Use
django.utils.html.format_htmlandformat_html_jointo build<datalist>and<option>elements with proper escaping. - Add HTML formatting utilities import for safe rendering.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
@copilot apply changes based on the comments in this thread |
Implemented in 3a909d2. I applied both review items from that thread: removed |
Agent-Logs-Url: https://github.com/inducer/relate/sessions/6722740f-c1cf-4fe7-8ad5-99c30150d47d Co-authored-by: inducer <352067+inducer@users.noreply.github.com>
Not much of an XSS because the source data is under instructor control.