-
-
Notifications
You must be signed in to change notification settings - Fork 1
New issue
Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? # to your account
v1.5.5 (#151) #152
v1.5.5 (#151) #152
Conversation
* Create abc.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Create abcd.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abc.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abcd.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abcd.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abcd.html (#134) Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abcd.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abcd.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abcd.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abcd.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abcd.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update index.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update and rename abcd.html to comentarios.html (#135) * Update and rename abcd.html to comentarios.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update tos.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update pp.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update artistas.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> --------- Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update comentarios.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update comentarios.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update comentarios.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abc.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abc.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abc.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abc.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abc.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abc.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abc.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Create abcd.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abcd.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abcd.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abcd.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Create #.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Create login.html (#136) * Create login.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update footer.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> --------- Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update comentarios.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update comentarios.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update comentarios.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update comentarios.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Actualizar abcd.html (#137) * Actualizar abcd.html * Update and rename abcd.html to comentarios1.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Rename comentarios.html to abcd.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Rename comentarios1.html to comentarios.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> --------- Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> Co-authored-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update comentarios.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update login.html (#138) * Update login.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update footer.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update #.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> --------- Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abc.html (#139) * Update abc.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Create abc.css Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Create abc.js Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abc.js Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> --------- Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abc.js Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abc.js Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update menu.html (#140) * Update menu.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update index.css Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abc.js Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update comentarios.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> --------- Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update comentarios.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update login.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update login.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update footer.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update footer.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update comentarios.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Actualizar comentarios.html (#141) * Update comentarios.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update comentarios.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update comentarios.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update comentarios.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Fix code scanning alert no. 36: Client-side cross-site scripting (#142) Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Fix code scanning alert no. 32: DOM text reinterpreted as HTML (#143) Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Create pacman.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update pacman.html (#144) * Update pacman.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Create a Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Add files via upload Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Delete music/a Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> --------- Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Add files via upload Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Add files via upload Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update pacman.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Add files via upload Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Add files via upload Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update pacman.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update pacman.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update pacman.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update pacman.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update pacman.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update pacman.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update pacman.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update footer.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update footer.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update footer.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update footer.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Create music.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update music.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update music.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update music.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update music.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update music.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Add files via upload (#145) * Add files via upload Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Add files via upload Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Add files via upload Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Add files via upload Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Add files via upload Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Delete Universal Union.mp3 Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Delete La Magia de la Estrella Polar (Versión Acústica).mp3 Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Delete La Magia de la Estrella Polar.mp3 Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Delete Magical Wishes.mp3 Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update music.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> --------- Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update music.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update equipo.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abcd.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abcd.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abcd.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abcd.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abcd.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abcd.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abcd.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update news.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Create a.html (#146) * Create a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Create a.js Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Create a.css Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> --------- Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.js Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.js Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.css Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.js Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update abc.js Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update footer.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.js Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.js Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html (#147) Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.js Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html (#149) Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.css (#148) * Update a.css Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.css Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.js Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.js Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> --------- Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html (#150) * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.js Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.js Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.js Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> --------- Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.js Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.js Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.js Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update a.js Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update grouvex-studios-recording.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update grouvex-studios-recording.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update grouvex-studios-recording.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update grouvex-studios-recording.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update footer.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update grouvex-studios-recording.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Create error.js Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update canciones.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update ep.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> * Update ep.html Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> --------- Signed-off-by: Grouvex <168425996+Grouvex@users.noreply.github.com> Co-authored-by: Grouvex Studio <grouvex.studio@gmail.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
</div> | ||
</section> | ||
</div> | ||
<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.9-1/crypto-js.js"></script> |
Check warning
Code scanning / CodeQL
Inclusion of functionality from an untrusted source Medium
const timestamp = new Date().getTime(); | ||
const commentSection = document.getElementById(section + 'Comments'); | ||
const commentPara = document.createElement('p'); | ||
commentPara.innerHTML = `<strong>${date} - ${nameText}:</strong> ${commentText} <span class="delete-button" onclick="requestDeleteComment(this)">🗑</span>`; |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium
DOM text
DOM text
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 4 months ago
To fix the problem, we need to ensure that any user input is properly escaped before being inserted into the HTML. This can be achieved by using text nodes instead of setting innerHTML
directly. We will create text nodes for the user input and append them to the DOM, which will prevent any HTML from being interpreted.
- Replace the use of
innerHTML
withtextContent
for the user input parts. - Create separate text nodes for the date, name, and comment text, and append them to the paragraph element.
-
Copy modified lines R196-R204
@@ -195,3 +195,11 @@ | ||
const commentPara = document.createElement('p'); | ||
commentPara.innerHTML = `<strong>${date} - ${nameText}:</strong> ${commentText} <span class="delete-button" onclick="requestDeleteComment(this)">🗑</span>`; | ||
const strongElement = document.createElement('strong'); | ||
strongElement.textContent = `${date} - ${nameText}:`; | ||
commentPara.appendChild(strongElement); | ||
commentPara.appendChild(document.createTextNode(` ${commentText} `)); | ||
const deleteButton = document.createElement('span'); | ||
deleteButton.className = 'delete-button'; | ||
deleteButton.textContent = '🗑'; | ||
deleteButton.onclick = function() { requestDeleteComment(this); }; | ||
commentPara.appendChild(deleteButton); | ||
commentPara.dataset.timestamp = timestamp; |
if (comments) { | ||
for (let id in comments) { | ||
const commentPara = document.createElement('p'); | ||
commentPara.innerHTML = `<strong>${new Date(comments[id].timestamp).toLocaleString()} - ${comments[id].name}:</strong> ${comments[id].comment} <span class="delete-button" onclick="requestDeleteComment(this)">🗑</span>`; |
Check failure
Code scanning / CodeQL
Client-side cross-site scripting High
user-provided value
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 4 months ago
To fix the problem, we need to ensure that any user-generated content is properly sanitized or encoded before being inserted into the DOM. The best way to fix this issue without changing existing functionality is to use a library like DOMPurify
to sanitize the user input. This will remove any potentially harmful scripts from the user-generated content.
- Include the
DOMPurify
library in the HTML file. - Use
DOMPurify
to sanitize thecomments[id].name
andcomments[id].comment
before inserting them into the DOM.
-
Copy modified line R7 -
Copy modified lines R284-R286
@@ -6,2 +6,3 @@ | ||
<script src="jquery-3.5.1.min.js"></script> | ||
<script src="https://cdnjs.cloudflare.com/ajax/libs/dompurify/2.3.4/purify.min.js"></script> | ||
<script> | ||
@@ -282,3 +283,5 @@ | ||
const commentPara = document.createElement('p'); | ||
commentPara.innerHTML = `<strong>${new Date(comments[id].timestamp).toLocaleString()} - ${comments[id].name}:</strong> ${comments[id].comment} <span class="delete-button" onclick="requestDeleteComment(this)">🗑</span>`; | ||
const sanitizedName = DOMPurify.sanitize(comments[id].name); | ||
const sanitizedComment = DOMPurify.sanitize(comments[id].comment); | ||
commentPara.innerHTML = `<strong>${new Date(comments[id].timestamp).toLocaleString()} - ${sanitizedName}:</strong> ${sanitizedComment} <span class="delete-button" onclick="requestDeleteComment(this)">🗑</span>`; | ||
commentPara.dataset.timestamp = comments[id].timestamp; |
Create abc.html
Create abcd.html
Update abc.html
Update abcd.html
Update abcd.html
Update abcd.html (Update abcd.html #134)
Update abcd.html
Update abcd.html
Update abcd.html
Update abcd.html
Update abcd.html
Update index.html
Update and rename abcd.html to comentarios.html (Update and rename abcd.html to comentarios.html #135)
Update and rename abcd.html to comentarios.html
Update tos.html
Update pp.html
Update artistas.html
Update comentarios.html
Update comentarios.html
Update comentarios.html
Update abc.html
Update abc.html
Update abc.html
Update abc.html
Update abc.html
Update abc.html
Update abc.html
Create abcd.html
Update abcd.html
Update abcd.html
Update abcd.html
Create #.html
Create login.html (Create login.html #136)
Create login.html
Update footer.html
Update comentarios.html
Update comentarios.html
Update comentarios.html
Update comentarios.html
Actualizar abcd.html (Actualizar abcd.html #137)
Actualizar abcd.html
Update and rename abcd.html to comentarios1.html
Rename comentarios.html to abcd.html
Rename comentarios1.html to comentarios.html
Update comentarios.html
Update login.html (Update login.html #138)
Update login.html
Update footer.html
Update #.html
Update abc.html (Update abc.html #139)
Update abc.html
Create abc.css
Create abc.js
Update abc.js
Update abc.js
Update abc.js
Update menu.html (Update menu.html #140)
Update menu.html
Update index.css
Update abc.js
Update comentarios.html
Update comentarios.html
Update login.html
Update login.html
Update footer.html
Update footer.html
Update comentarios.html
Actualizar comentarios.html (Actualizar comentarios.html #141)
Update comentarios.html
Update comentarios.html
Update comentarios.html
Update comentarios.html
Fix code scanning alert no. 36: Client-side cross-site scripting (Fix code scanning alert no. 36: Client-side cross-site scripting #142)
Fix code scanning alert no. 32: DOM text reinterpreted as HTML (Fix code scanning alert no. 32: DOM text reinterpreted as HTML #143)
Create pacman.html
Update pacman.html (Update pacman.html #144)
Update pacman.html
Create a
Add files via upload
Delete music/a
Add files via upload
Add files via upload
Update pacman.html
Add files via upload
Add files via upload
Update pacman.html
Update pacman.html
Update pacman.html
Update pacman.html
Update pacman.html
Update pacman.html
Update pacman.html
Update footer.html
Update footer.html
Update footer.html
Update footer.html
Create music.html
Update music.html
Update music.html
Update music.html
Update music.html
Update music.html
Add files via upload (Add files via upload #145)
Add files via upload
Add files via upload
Add files via upload
Add files via upload
Add files via upload
Delete Universal Union.mp3
Delete La Magia de la Estrella Polar (Versión Acústica).mp3
Delete La Magia de la Estrella Polar.mp3
Delete Magical Wishes.mp3
Update music.html
Update music.html
Update equipo.html
Update abcd.html
Update abcd.html
Update abcd.html
Update abcd.html
Update abcd.html
Update abcd.html
Update abcd.html
Update news.html
Create a.html (Create a.html #146)
Create a.html
Create a.js
Create a.css
Update a.html
Update a.js
Update a.html
Update a.html
Update a.html
Update a.html
Update a.html
Update a.html
Update a.js
Update a.html
Update a.css
Update a.js
Update a.html
Update abc.js
Update footer.html
Update a.html
Update a.js
Update a.html
Update a.html
Update a.html
Update a.html
Update a.js
Update a.html
Update a.html
Update a.html
Update a.html
Update a.html
Update a.html (Update a.html #147)
Update a.js
Update a.html (Update a.html #149)
Update a.css (Update a.css #148)
Update a.css
Update a.css
Update a.js
Update a.js
Update a.html
Update a.html (Update a.html #150)
Update a.html
Update a.js
Update a.js
Update a.html
Update a.js
Update a.html
Update a.js
Update a.html
Update a.html
Update a.html
Update a.js
Update a.html
Update a.html
Update a.html
Update a.html
Update a.js
Update a.js
Update grouvex-studios-recording.html
Update grouvex-studios-recording.html
Update grouvex-studios-recording.html
Update grouvex-studios-recording.html
Update footer.html
Update grouvex-studios-recording.html
Create error.js
Update canciones.html
Update ep.html
Update ep.html