Text injection on online version

[Nanoseb]

Hello world,
At the bottom of the website there is some russian text advertising for online betting.
I don't know how can this happen, and it wasn't there a year ago (from archive.org).
It may be related to the 3 pending security 'issues', but these don't seem to be just one click fixes, so I will have a look at it probably only over the week-end.
If any of you have have experience with this feel free to jump in,
Cheers
Seb

[zysim]

I'll see what I can do.

[zysim]

I don't see where the security issues are?

[Nanoseb]

Awesome, thanks.
There is a "Security" tab between Wiki and Insight with Dependabot alerts.

[zysim]

I don't see the Dependabot stuff for some reason; maybe because I'm not the code owner?

Anyway; just tried setting up that code scanning thing just because it sounds good lol.

[Nanoseb]

ok, what about now? (I've set you as a maintainer)

[zysim]

Still this:

Maybe you might need to work on this after all?

[Nanoseb]

and now ;)
(just put you as admin, should work, I thought maintainer was gonna be enough)

[zysim]

There we go :D

Okay I'll actually take a crack at this now haha

[zysim]

☝️ ☝️ Made that above PR because our lockfile's apparently broken. Found this out from going through the Dependabot alerts. In fact, it should solve all our alerts, as our lockfile now lists the latest versions of the affected dependencies. Our lockfile does leave out (i.e. we don't install) ffi and redcarpet though. However, the site still runs fine locally, so we might not actually have needed them to begin with.

If you could Seb, mind giving that PR a try on your machine too?

[Nanoseb]

Cool, thanks
And all right, I'll give it a go this evening