diff options
| author | neobooru <50623835+neobooru@users.noreply.github.com> | 2021-04-12 10:42:58 +0200 |
|---|---|---|
| committer | neobooru <50623835+neobooru@users.noreply.github.com> | 2021-04-12 10:42:58 +0200 |
| commit | 4ce72fa712918934fec019743dabc3387b2b6bcc (patch) | |
| tree | 777f2069c6f82d37d58f6b6e47dae47fa043dcff /client/js/controls | |
| parent | 7c37734fec508f82f757c299175674b755d0ac71 (diff) | |
client/tags: escape dots in search term and don't allow '.' and '..' as tags
Diffstat (limited to 'client/js/controls')
| -rw-r--r-- | client/js/controls/tag_input_control.js | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/client/js/controls/tag_input_control.js b/client/js/controls/tag_input_control.js index 2207f41..1ac1cb3 100644 --- a/client/js/controls/tag_input_control.js +++ b/client/js/controls/tag_input_control.js @@ -163,7 +163,8 @@ class TagInputControl extends events.EventTarget { addTagByName(name, source) { name = name.trim(); - if (!name) { + // Tags `.` and `..` are not allowed, see https://github.com/rr-/szurubooru/pull/390 + if (!name || name == "." || name == "..") { return; } return Tag.get(name).then( |