nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqjyfhtfwc40hrc7pxrxvp5ztve3nz4lc4yrxguq2saxpycwmre78q6m9q72 Did you use template variable interpolation?
@hypolite Specifically I'm in the process of updating this addon: gitlab.com/randompenguin/bookf… which you can see uses the settings template and add-on and the footer hooks. So, no, it's not going through a template to display it's appending to the HTML in the footer hook. So that can't really be filtering HTML code, including scripts.
I wasn't surprised that the footer hook wrote the script into the page, I've seen other add-ons include dynamically generated footer scripts that way. I'm actually generating a <style> block that way. It was more that I was surprised the pConfig() and config() don't sanitize the config values before saving them into the database.
Maybe it's because I've spent so many years working of WordPress stuff where you never trust anything entered in a form and sanitize it all before it goes into the database.
I guess I'll just include the sanitizing in my add-on, but I was wondering if there's already a function like that in Friendica I can use or if I need to write my own function for the task?
I wasn't surprised that the footer hook wrote the script into the page, I've seen other add-ons include dynamically generated footer scripts that way. I'm actually generating a <style> block that way. It was more that I was surprised the pConfig() and config() don't sanitize the config values before saving them into the database.
Maybe it's because I've spent so many years working of WordPress stuff where you never trust anything entered in a form and sanitize it all before it goes into the database.
I guess I'll just include the sanitizing in my add-on, but I was wondering if there's already a function like that in Friendica I can use or if I need to write my own function for the task?
1
