From 35d1e6a8b185a652b813f96df520551007ed477e Mon Sep 17 00:00:00 2001
From: Pierre HUBERT <pierre.git@communiquons.org>
Date: Mon, 8 Mar 2021 17:19:26 +0100
Subject: [PATCH] Block HTML content in posts content

---
 .../assets/js/categories/posts.js             |  2 +-
 .../assets/js/main.js                         |  2 +-
 .../assets/js/utils.js                        | 31 +++++++++++++++++++
 3 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/assets/zip/personnal-data-export-navigator/assets/js/categories/posts.js b/assets/zip/personnal-data-export-navigator/assets/js/categories/posts.js
index 2bb64d66..d3dbce68 100644
--- a/assets/zip/personnal-data-export-navigator/assets/js/categories/posts.js
+++ b/assets/zip/personnal-data-export-navigator/assets/js/categories/posts.js
@@ -106,7 +106,7 @@ function ApplyPosts(){
 			appendTo: cardContent,
 			type: "div",
 			class: "post-content",
-			innerHTML: post.content
+			innerHTML: removeHtmlTags(post.content)
 		});
 
 
diff --git a/assets/zip/personnal-data-export-navigator/assets/js/main.js b/assets/zip/personnal-data-export-navigator/assets/js/main.js
index 6ccd6114..94c8cc77 100644
--- a/assets/zip/personnal-data-export-navigator/assets/js/main.js
+++ b/assets/zip/personnal-data-export-navigator/assets/js/main.js
@@ -20,7 +20,7 @@ function RefreshTabsVisibility(){
 	var hash = location.href.toString().split("#")[1];
 
 	if(!hash)
-		return;
+		hash = "home";
 
 	document.querySelectorAll(".category").forEach(el => {
 
diff --git a/assets/zip/personnal-data-export-navigator/assets/js/utils.js b/assets/zip/personnal-data-export-navigator/assets/js/utils.js
index 3c9e3ba1..5de197c0 100644
--- a/assets/zip/personnal-data-export-navigator/assets/js/utils.js
+++ b/assets/zip/personnal-data-export-navigator/assets/js/utils.js
@@ -240,4 +240,35 @@ function userID() {
  */
 function fileSizeToHuman(size) {
 	return Math.round(size/(1000*1000)*1000)/1000 + "MB";
+}
+
+/**
+ * Remove HTML carachters : < and >
+ * 
+ * @param {String} input The string to change
+ * @return {String} The updated string
+ */
+function removeHtmlTags(input){
+	
+	//Check if input string is empty
+	if(input == null || typeof input !== "string")
+		return "";
+
+	//Prepare update
+	var output = input;
+	
+	//Replace opening braces
+	while(output.includes("<")){
+		//Replace an occurence
+		output = output.replace("<", "&lt;");
+	}
+
+	//Replace closing braces
+	while(output.includes(">")){
+		//Replace an occurence
+		output = output.replace(">", "&gt;");
+	}
+	
+	//Return result
+	return output;
 }
\ No newline at end of file