1
0
Fork 0
mirror of https://github.com/TryGhost/Ghost-Admin.git synced 2023-12-14 02:33:04 +01:00
Ghost-Admin/app/components/gh-user-active.js
Kevin Ansfield bd458ba1f9 add extra escaping when using htmlSafe on user input (#469)
no issue
- ensure that we always pre-escape user input when it's used within `htmlSafe` marked output
2017-01-04 08:52:00 -07:00

33 lines
991 B
JavaScript

import Ember from 'ember';
import Component from 'ember-component';
import computed from 'ember-computed';
import injectService from 'ember-service/inject';
import {htmlSafe} from 'ember-string';
// ember-cli-shims doesn't export these
const {Handlebars} = Ember;
export default Component.extend({
tagName: '',
user: null,
ghostPaths: injectService(),
userDefault: computed('ghostPaths', function () {
return `${this.get('ghostPaths.assetRoot')}/img/user-image.png`;
}),
userImageBackground: computed('user.image', 'userDefault', function () {
let url = this.get('user.image') || this.get('userDefault');
let safeUrl = Handlebars.Utils.escapeExpression(url);
return htmlSafe(`background-image: url(${safeUrl})`);
}),
lastLoginUTC: computed('user.lastLoginUTC', function () {
let lastLoginUTC = this.get('user.lastLoginUTC');
return lastLoginUTC ? moment(lastLoginUTC).fromNow() : '(Never)';
})
});