djsundog/brutaldon
1
0
Fork 0
mirror of http://git.carcosa.net/jmcbray/brutaldon.git synced 2024-11-23 15:23:52 -05:00
Code Issues Projects Releases Wiki Activity

Fix unescaping of html in template filters.

Browse Source 
This was not a security bug, because it was done before passing code to
sanitize, but it was totally an annoying UI bug.
This commit is contained in:
Jason McBrayer 2018-06-06 15:21:00 -04:00
parent e05601db22
commit d0770dbbe1
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
brutaldon/templatetags/taglinks.py
View File

@ -2,9 +2,15 @@ from django import template
from bs4 import BeautifulSoup
from urllib import parse
from django.urls import reverse
from pdb import set_trace
register = template.Library()
@register.filter
def pdb(element):
set_trace()
return element
@register.filter
def relink_tags(value):
'''Treat the text as html, and replace tag links with app-internal tag links
@ -18,7 +24,7 @@ def relink_tags(value):
soup = BeautifulSoup(value, 'html.parser')
for link in soup.find_all('a', class_='hashtag'):
link['href'] = reverse('tag', args=[link.span.string])
return soup.decode(formatter=None)
return soup.decode(formatter='html')
@register.filter
def relink_mentions(value):
@ -39,7 +45,7 @@ def relink_mentions(value):
link['href'] = reverse('user', args=[user+'@'+instance])
except:
continue
return soup.decode(formatter=None)
return soup.decode(formatter='html')
@register.filter
def relink_toot(value):