diff --git a/client/src/view-helper.js b/client/src/view-helper.js index ff93dc4817..be2724fb64 100644 --- a/client/src/view-helper.js +++ b/client/src/view-helper.js @@ -318,8 +318,8 @@ define('view-helper', ['lib!client/lib/purify.min.js'], function () { return html; }, - sanitizeHtml: function (text) { - return DOMPurify.sanitize(text); + sanitizeHtml: function (text, options) { + return DOMPurify.sanitize(text, options); }, }); diff --git a/client/src/views/fields/wysiwyg.js b/client/src/views/fields/wysiwyg.js index ab2718e9d9..15311c2c7c 100644 --- a/client/src/views/fields/wysiwyg.js +++ b/client/src/views/fields/wysiwyg.js @@ -159,7 +159,10 @@ Espo.define('views/fields/wysiwyg', ['views/fields/text', 'lib!Summernote'], fun value = value.replace(/<[^><]*([^a-z]{1}on[a-z]+)=[^><]*>/gi, function (match) { return match.replace(/[^a-z]{1}on[a-z]+=/gi, ' data-handler-stripped='); }); - value = this.getHelper().sanitizeHtml(value); + + value = value.replace(/()/g, ''); + value = this.getHelper().sanitizeHtml(value, {ADD_TAGS: ['comment']}); + value = value.replace(/()/g,''); } return value || ''; },