Ilia Denisov b54371845f harden(offer): escape admin product titles against HTML/markdown injection ...

The offer price list projects the admin-entered product title into a markdown
table cell that is rendered, unsanitised, into the public /offer/ page. Escape
the title at the projection boundary so it renders as literal text: HTML
metacharacters become entities and the markdown table pipe and link brackets are
escaped, so a title can neither inject markup nor form a javascript: link. The
committed offer prose keeps its trusted-content treatment (code-reviewed, not
runtime input).

2026-07-10 20:30:36 +02:00

..

account

feat(ads): VK post-move interstitial + retire deprecated hint_balance/paid_account

2026-07-10 02:48:10 +02:00

accountdelete

feat(accountdelete): drop all-robot games + unspoofable [Deleted] label

2026-07-03 13:02:14 +02:00

accountmerge

feat(payments): chip wallet, store-compliance gate and benefit application

2026-07-08 06:06:40 +02:00

adminalert

feat(email): PWA login sends code only; drop admin link from alert emails

2026-07-05 22:13:21 +02:00

adminconsole

fix(ui): one-word games must not highlight phantom cross words; review polish

2026-07-10 15:58:05 +02:00

ads

feat(payments): chip wallet, store-compliance gate and benefit application

2026-07-08 06:06:40 +02:00

banview

feat(gateway): temporary IP ban (fail2ban) fed by rejections + honeypot/honeytoken

2026-06-21 08:54:20 +02:00

config

feat(payments): direct-rail order + intake handlers, config and reaper

2026-07-09 16:59:34 +02:00

connector

feat(telegram): split connector into home validator + remote bot

2026-06-21 00:19:07 +02:00

dictadmin

feat(admin): online dictionary update — upload archive, preview word diff, install & activate

2026-06-13 23:29:06 +02:00

engine

feat(offline): local game engine (Phase B1)

2026-07-06 08:02:05 +02:00

feedback

feat(adminalert): operator email on new feedback / word complaints

2026-07-03 14:53:51 +02:00

game

fix(games): carry game kind on live events + fix the New Game lock funnel

2026-07-10 10:55:48 +02:00

gamelimits

feat(backend): per-tier, per-kind active-game limits with a guest funnel

2026-07-10 09:03:57 +02:00

inttest

feat(offer): live catalog price list in the public offer, served by the render sidecar

2026-07-10 20:25:41 +02:00

link

feat(payments): trusted platform signal on the session

2026-07-08 03:31:51 +02:00

lobby

feat(backend): per-tier, per-kind active-game limits with a guest funnel

2026-07-10 09:03:57 +02:00

notify

fix(games): carry game kind on live events + fix the New Game lock funnel

2026-07-10 10:55:48 +02:00

payments

harden(offer): escape admin product titles against HTML/markdown injection

2026-07-10 20:30:36 +02:00

postgres

feat(backend): per-tier, per-kind active-game limits with a guest funnel

2026-07-10 09:03:57 +02:00

pushgrpc

feat(telegram,game): single bot + per-user variant preferences

2026-06-20 14:23:25 +02:00

ratewatch

R6(a): de-stage code, docs, READMEs; split stage6_test

2026-06-10 16:56:03 +02:00

render

feat(export): server-rendered artifacts behind one signed download URL (#160)

2026-07-02 21:58:07 +00:00

robokassa

feat(payments): order-flow and fund credit engine + the Robokassa adapter

2026-07-09 16:48:48 +02:00

robot

feat(offline): port robot move-choice strategy to TS (parity-pinned)

2026-07-06 01:54:20 +02:00

server

feat(offer): live catalog price list in the public offer, served by the render sidecar

2026-07-10 20:25:41 +02:00

session

feat(payments): trusted platform signal on the session

2026-07-08 03:31:51 +02:00

social

feat(backend): per-tier, per-kind active-game limits with a guest funnel

2026-07-10 09:03:57 +02:00

telemetry

Stage 12: observability & performance (OTel/OTLP, domain metrics, guest GC)

2026-06-04 14:22:15 +02:00