From 7af0f9f47e6a1f86147183a30cd8a9f686bc3f7d Mon Sep 17 00:00:00 2001
From: Eileen McNaughton <emcnaughton@wikimedia.org>
Date: Wed, 24 Nov 2021 11:34:10 +1300
Subject: [PATCH] Bypass any default escaping for blog, getting started

This specifies that default escaping should not apply to the blog, getting started.

I added purify to the data coming from the blog - this is our blog so should be
safe but it is techically 3rd part data
---
 templates/CRM/Dashlet/Page/Blog.tpl           | 8 ++++----
 templates/CRM/Dashlet/Page/GettingStarted.tpl | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/templates/CRM/Dashlet/Page/Blog.tpl b/templates/CRM/Dashlet/Page/Blog.tpl
index be40890a77..4502180598 100644
--- a/templates/CRM/Dashlet/Page/Blog.tpl
+++ b/templates/CRM/Dashlet/Page/Blog.tpl
@@ -47,12 +47,12 @@
     {foreach from=$channel.items item=article}
       <div class="crm-accordion-wrapper collapsed">
         <div class="crm-accordion-header">
-          <span class="crm-news-feed-item-title">{$article.title}</span>
-          <span class="crm-news-feed-item-preview"> - {if function_exists('mb_substr')}{$article.description|strip_tags|mb_substr:0:150}{else}{$article.description|strip_tags}{/if}</span>
+          <span class="crm-news-feed-item-title">{$article.title|smarty:nodefaults|purify}</span>
+          <span class="crm-news-feed-item-preview"> - {if function_exists('mb_substr')}{$article.description|smarty:nodefaults|strip_tags|mb_substr:0:150}{else}{$article.description|smarty:nodefaults|strip_tags}{/if}</span>
         </div>
         <div class="crm-accordion-body">
-          <div>{$article.description}</div>
-          <p class="crm-news-feed-item-link"><a target="_blank" href="{$article.link}" title="{$article.title|escape}"><i class="crm-i fa-external-link" aria-hidden="true"></i> {ts}read more{/ts}…</a></p>
+          <div>{$article.description|smarty:nodefaults|purify}</div>
+          <p class="crm-news-feed-item-link"><a target="_blank" href="{$article.link|smarty:nodefaults|purify}" title="{$article.title|escape}"><i class="crm-i fa-external-link" aria-hidden="true"></i> {ts}read more{/ts}…</a></p>
         </div>
       </div>
     {/foreach}
diff --git a/templates/CRM/Dashlet/Page/GettingStarted.tpl b/templates/CRM/Dashlet/Page/GettingStarted.tpl
index ce458b6193..3d02fb8602 100644
--- a/templates/CRM/Dashlet/Page/GettingStarted.tpl
+++ b/templates/CRM/Dashlet/Page/GettingStarted.tpl
@@ -8,4 +8,4 @@
  +--------------------------------------------------------------------+
 *}
 
-<div id="civicrm-getting-started">{$gettingStarted}</div>
+<div id="civicrm-getting-started">{$gettingStarted|smarty:nodefaults}</div>
-- 
2.25.1