alphard/ComfyUI-Lora-Manager
1
0
Fork 0
mirror of https://github.com/willmiao/ComfyUI-Lora-Manager.git synced 2026-03-21 21:22:11 -03:00
Code Issues Packages Projects Releases Wiki Activity

Fix: Escape HTML in Prompt/NegativePrompt for MetadataPanel

Browse Source 
* Fixed a bug where `prompt` and `negativePrompt` were both being
  added directly to HTML without escaping them. Given prompts are
  allowed to have HTML characters (e.g. `<lora:something:0.75>`), by
  forgetting to escape them some tags were missing in the metadata
  views for example images using those characters.
This commit is contained in:
botchedchuckle
2026-03-13 01:29:04 -07:00
committed by GitHub
parent 4fcf641d57
commit 7570936c75
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
static/js/components/shared/showcase/MetadataPanel.js
View File

@@ -2,6 +2,7 @@
* MetadataPanel.js * MetadataPanel.js
* Generates metadata panels for showcase media items * Generates metadata panels for showcase media items
*/ */
import { escapeHtml } from '../utils.js';
/** /**
* Generate metadata panel HTML * Generate metadata panel HTML
@@ -49,6 +50,7 @@ export function generateMetadataPanel(hasParams, hasPrompts, prompt, negativePro
} }
if (prompt) { if (prompt) {
prompt = escapeHtml(prompt);
content += ` content += `
<div class="metadata-row prompt-row"> <div class="metadata-row prompt-row">
<span class="metadata-label">Prompt:</span> <span class="metadata-label">Prompt:</span>
@@ -64,6 +66,7 @@ export function generateMetadataPanel(hasParams, hasPrompts, prompt, negativePro
} }
if (negativePrompt) { if (negativePrompt) {
negativePrompt = escapeHtml(negativePrompt);
content += ` content += `
<div class="metadata-row prompt-row"> <div class="metadata-row prompt-row">
<span class="metadata-label">Negative Prompt:</span> <span class="metadata-label">Negative Prompt:</span>
@@ -80,4 +83,4 @@ export function generateMetadataPanel(hasParams, hasPrompts, prompt, negativePro
content += '</div></div>'; content += '</div></div>';
return content; return content;
} }