From 5d56c2cecd6372f58cbfa134a23a2b5fc96418d3 Mon Sep 17 00:00:00 2001
From: jekkos <jekkos@users.noreply.github.com>
Date: Tue, 29 Sep 2026 13:19:10 +0200
Subject: [PATCH] fix(security): strip all HTML tags from $.notify alert
 messages (#4716)

---
 app/Views/partial/header_js.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/Views/partial/header_js.php b/app/Views/partial/header_js.php
index 057324db1..f3f38003e 100644
--- a/app/Views/partial/header_js.php
+++ b/app/Views/partial/header_js.php
@@ -21,7 +21,7 @@
 
     $.notify = function(content, options) {
         const message = typeof content === "object" ? content.message : content;
-        const sanitizedMessage = DOMPurify.sanitize(message);
+        const sanitizedMessage = DOMPurify.sanitize(message, { ALLOWED_TAGS: [], ALLOWED_ATTR: [] });
         return notify(sanitizedMessage, options);
     };