mirror of
https://github.com/duckietm/Nitro-V3.git
synced 2026-06-19 15:06:20 +00:00
7ffb213ce7
- XSS fix: Created SanitizeHtml.ts utility using DOMPurify (already in package.json but never used). Wrapped all 21 dangerouslySetInnerHTML calls in catalog views with SanitizeHtml() — only allows safe tags (b, i, u, br, span, div, p, a, strong, em, img) - Race condition fix: Added 10-second timeout fallbacks on purchase flags in CatalogPurchaseWidgetView and CatalogGiftView so the flag auto-resets even if the server never responds
38 lines
1.7 KiB
TypeScript
38 lines
1.7 KiB
TypeScript
import { FC } from 'react';
|
|
import { FaPaw } from 'react-icons/fa';
|
|
import { SanitizeHtml } from '../../../../../api';
|
|
import { CatalogLayoutProps } from './CatalogLayout.types';
|
|
|
|
export const CatalogLayoutPets3View: FC<CatalogLayoutProps> = props =>
|
|
{
|
|
const { page = null } = props;
|
|
|
|
const imageUrl = page.localization.getImage(1);
|
|
|
|
return (
|
|
<div className="flex flex-col h-full gap-2">
|
|
{ /* Header card */ }
|
|
<div className="flex items-center gap-3 p-2.5 bg-white rounded border-2 border-card-grid-item-border">
|
|
{ imageUrl && <img alt="" className="w-[60px] h-[60px] object-contain shrink-0" src={ imageUrl } /> }
|
|
<div>
|
|
<div className="flex items-center gap-1.5 mb-0.5">
|
|
<FaPaw className="text-primary text-xs" />
|
|
<span className="text-sm font-bold" dangerouslySetInnerHTML={ { __html: SanitizeHtml(page.localization.getText(1)) } } />
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
{ /* Content */ }
|
|
<div className="flex-1 overflow-auto bg-white rounded border-2 border-card-grid-item-border p-3">
|
|
<div className="text-[11px] leading-relaxed" dangerouslySetInnerHTML={ { __html: SanitizeHtml(page.localization.getText(2)) } } />
|
|
</div>
|
|
|
|
{ /* Footer */ }
|
|
{ !!page.localization.getText(3) &&
|
|
<div className="p-2 bg-card-grid-item rounded border border-card-grid-item-border">
|
|
<span className="text-[11px] font-bold" dangerouslySetInnerHTML={ { __html: SanitizeHtml(page.localization.getText(3)) } } />
|
|
</div> }
|
|
</div>
|
|
);
|
|
};
|