TW21240105, cleaning comments before rendering

brickfield · Feb 17, 2025 · ffdb962 · ffdb962
1 parent 94070de
commit ffdb962
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/external.php b/external.php
@@ -708,7 +708,7 @@ public static function get_comments($noteid) {
             $comment = (object)[];
             $comment->id = $note->id;
             $comment->noteid = $note->noteid;
-            $comment->content = $note->content;
+            $comment->content = clean_param($note->content, PARAM_TEXT);
             $comment->candelete = (($canpost && $note->userid === $USER->id) || $candeleteall) ? true : false;
             $comment->date = userdate($note->timecreated);
             $comments[] = $comment;