merge: laxer HTML sanitisation for admin-controlled text - fixes #447 (!454)

View MR for information: https://activitypub.software/TransFem-org/Sharkey/-/merge_requests/454

Closes #447

Approved-by: Marie <marie@kaifa.ch>

packages/backend/src/server/web/views/note.pug

@@ -5,8 +5,8 @@ block vars
 	- const title = user.name ? `${user.name} (@${user.username})` : `@${user.username}`;
 	- const url = `${config.url}/notes/${note.id}`;
 	- const isRenote = note.renote && note.text == null && note.fileIds.length == 0 && note.poll == null;
-	- const images = note.cw ? [] : (note.files || []).filter(file => file.type.startsWith('image/') && !file.isSensitive)
-	- const videos = note.cw ? [] : (note.files || []).filter(file => file.type.startsWith('video/') && !file.isSensitive)
+	- const images = (note.files || []).filter(file => file.type.startsWith('image/') && !file.isSensitive)
+	- const videos = (note.files || []).filter(file => file.type.startsWith('video/') && !file.isSensitive)
 
 block title
 	= `${title} | ${instanceName}`