From 097a211bbe15127c36e93bde9c8ca2f112f7db0e Mon Sep 17 00:00:00 2001
From: erdgeist <erdgeist@erdgeist.org>
Date: Sun, 2 Aug 2026 02:46:33 +0200
Subject: Let the sanitizer honour what the editor permits

---
 app/helpers/content_helper.rb | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'app')

diff --git a/app/helpers/content_helper.rb b/app/helpers/content_helper.rb
index b2603481..c88267c3 100644
--- a/app/helpers/content_helper.rb
+++ b/app/helpers/content_helper.rb
@@ -106,7 +106,8 @@ module ContentHelper
   def aggregate? content
     options = {}
 
-    cccms_attributes = ActionView::Base.sanitized_allowed_attributes + ['lang']
+    cccms_attributes = ActionView::Base.sanitized_allowed_attributes +
+                       %w[lang target rel data-gallery]
 
     begin
       if content =~ /\[aggregate([^\]]*)\]/
-- 
cgit v1.3