mirror of
https://github.com/pezkuwichain/pwap.git
synced 2026-07-27 06:35:41 +00:00
fix(web): repair 6 dead internal links + harden forum markdown against stored XSS
Routing: footer "Explorer"/"Validators" pointed to non-existent /network (4 spots in AppLayout + LandingPageDesktop) and Explorer/Forum quick-links pointed to bare /governance (no route) -> all hit the 404 catch-all. Repointed to /explorer and /governance/assembly; footer "Vote" /-> /elections. Security (stored XSS): DiscussionThread.parseMarkdown did regex->HTML then dangerouslySetInnerHTML with no escaping/sanitizer, so <img onerror>/javascript: links in user comments executed. Now escape HTML first, then DOMPurify-sanitize the output to a safe tag/attr allow-list with http(s)-only hrefs.
This commit is contained in:
@@ -659,9 +659,9 @@ const AppLayout: React.FC = () => {
|
||||
<div className="lp-foot-col">
|
||||
<h5>{t('landing.footer.network')}</h5>
|
||||
<ul>
|
||||
<li><a href="/network">{t('landing.footer.explorer')}</a></li>
|
||||
<li><a href="/explorer">{t('landing.footer.explorer')}</a></li>
|
||||
<li><a href="/telemetry">{t('landing.footer.telemetry')}</a></li>
|
||||
<li><a href="/network">{t('landing.footer.validators')}</a></li>
|
||||
<li><a href="/explorer">{t('landing.footer.validators')}</a></li>
|
||||
<li><a href="/faucet">{t('landing.footer.faucet')}</a></li>
|
||||
</ul>
|
||||
</div>
|
||||
@@ -670,7 +670,7 @@ const AppLayout: React.FC = () => {
|
||||
<ul>
|
||||
<li><a href="/wallet">{t('landing.footer.wallet')}</a></li>
|
||||
<li><a href="/p2p">{t('landing.footer.trade')}</a></li>
|
||||
<li><a href="/">{t('landing.footer.vote')}</a></li>
|
||||
<li><a href="/elections">{t('landing.footer.vote')}</a></li>
|
||||
<li><a href="/grants">{t('landing.footer.grants')}</a></li>
|
||||
</ul>
|
||||
</div>
|
||||
@@ -689,7 +689,7 @@ const AppLayout: React.FC = () => {
|
||||
<li><a href="/forum">{t('landing.footer.forum')}</a></li>
|
||||
<li><a href="https://discord.gg/pezkuwichain" target="_blank" rel="noopener noreferrer">{t('landing.footer.discord')}</a></li>
|
||||
<li><a href="https://t.me/PezkuwiApp" target="_blank" rel="noopener noreferrer">{t('landing.footer.telegram')}</a></li>
|
||||
<li><a href="https://x.com/PezkuwiChain" target="_blank" rel="noopener noreferrer">{t('landing.footer.twitter')}</a></li>
|
||||
<li><a href="https://x.com/bizinikiwi" target="_blank" rel="noopener noreferrer">{t('landing.footer.twitter')}</a></li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
Reference in New Issue
Block a user