audit

2026-04-20 18:05:36 +00:00
parent d73422555d
commit 33b1f276c6
26 changed files with 598 additions and 183 deletions
--- a/services/staffSignature.js
+++ b/services/staffSignature.js
@@ -1,4 +1,5 @@
 const { mongoose } = require('../db-connection');
+const { escapeHtml } = require('../utils');

 /**
 * Returns { text, html } for a staff member's signature.
@@ -17,7 +18,7 @@ async function getStaffSignatureBlocks(userId) {
  if (sig.tagline) lines.push(sig.tagline);

  const text = lines.join('\n');
-  const html = lines.map(l => `<div>${l}</div>`).join('');
+  const html = lines.map(l => `<div>${escapeHtml(l)}</div>`).join('');

  return { text, html };
 }