fix(backend): sanitize group description

Created by: Mogge

Pullrequest

Sanitizes the html of group description and description excerpt. Additional argument to the walk recursive function to pass field names that should not be sanitized.

Issues

• fixes #5668 (closed)

Todo

• None

backend/src/helpers/walkRecursive.js

@@ -2,24 +2,26 @@
  * iterate through all fields and replace it with the callback result
  * @property data Array
  * @property fields Array
+ * @property fieldName String
  * @property callback Function
  */
-function walkRecursive(data, fields, callback, _key) {
+function walkRecursive(data, fields, fieldName, callback, _key) {
   if (!Array.isArray(fields)) {
     throw new Error('please provide an fields array for the walkRecursive helper')
   }
   if (data && typeof data === 'string' && fields.includes(_key)) {
     // well we found what we searched for, lets replace the value with our callback result
-    data = callback(data, _key)
+    const key = _key.split('!')
+    if (key.length === 1 || key[1] !== fieldName) data = callback(data, key[0])
   } else if (data && Array.isArray(data)) {
     // go into the rabbit hole and dig through that array
     data.forEach((res, index) => {
-      data[index] = walkRecursive(data[index], fields, callback, index)
+      data[index] = walkRecursive(data[index], fields, fieldName, callback, index)
     })
   } else if (data && typeof data === 'object') {
     // lets get some keys and stir them
     Object.keys(data).forEach((k) => {
-      data[k] = walkRecursive(data[k], fields, callback, k)
+      data[k] = walkRecursive(data[k], fields, fieldName, callback, k)
     })
   }
   return data

[Hannes Heine]

Created by: ulfgebhardt

I do not understand key[1] !== fieldName shouldnt't it be key[0] !== fieldName or have `callback(data, key.length === 1 ? key[0] : key[1])

[Hannes Heine]

Created by: Mogge

It is description!embed.

[Hannes Heine]

Created by: Mogge

And I want to pass description to the callback