Mike Dalessio
e9cb2956ee
Remove data-action from the sanitizer allowlist to disallow injection of potentially malicious Stimulus actions in user-provided content. The lightbox controller now uses imageTarget callbacks to handle clicks on image links. Also add the file name as a caption in the light box, and fix the caption color for dark mode visibility.
7 lines
337 B
Plaintext
7 lines
337 B
Plaintext
<%= render "cards/display/common/background", card: card do %>
|
|
<%= link_to card.image.presence, class: "btn fill-transparent flex-item-justify-end", data: { controller: "tooltip", lightbox_target: "image" } do %>
|
|
<%= icon_tag "picture-zoom" %>
|
|
<span class="for-screen-reader">Zoom background image</span>
|
|
<% end %>
|
|
<% end %>
|