Custom HTML printed escaped

Version: 4.7.9.6

Go to Forms => Settings => Styling Settings => Custom HTML and add some code.
Code provided there will be printed escaped on the frontend.

Also HTML input will be turned into plain text when saving. That’s usually not what “HTML” means. (It’s bad practice to change user input btw.)

Once upon a time all this has worked – but one of the last updates (probably after your security novice has finished his meanwhile famous work, without testing afterwards as usual) turned this into a new bug.

I would really appreciate when working code doesn’t stop working again and again as this has happened several times in the last months.

Please test changes before releasing, especially when you think you have hardened your code.

Thanks for all the hard work.

• This topic was modified 2 years, 7 months ago by Frank.