Revize 343aa66b

Sanitize document preview

Backend/Core/Services/DocumentService/DocumentServiceEF.cs

@@ -176 +176 @@
             {
                 var document = databaseContext.Documents.Include(d => d.Content).Single(d => d.Id == documentId);
                 HtmlSanitizer sanitizer = new HtmlSanitizer();
+                sanitizer.AllowedAttributes.Clear();
+                if (sanitizer.AllowedTags.Contains("img"))
+                {
+                    sanitizer.AllowedTags.Remove("img");
+                }
                 return new DocumentPreviewResponse()
                 {
                     Content = sanitizer.Sanitize(document.Content.Content)