3 ms·

Supporting HTML in the description makes XSS more likely: https://provetheywantit.com/project?public_token=pub_KSUPBwlYYYevfIdgAmxiIsGqXPledKwqfbNN https://pro

• repartix 6y ago
  Does XSS in the description hurt? There's nothing to steal from the /project page and it's not displayed in /admin.
  • withinboredom 6y ago
    Do you really want someone to inject some js that says "click here to receive notifications about this project" that actually sends them spam notifications?
    • repartix 6y ago
      Fixed, thanks! Also urls get hyperlinked now.