mirrors/gotosocial
1
0
Fork 0
mirror of https://github.com/superseriousbusiness/gotosocial.git synced 2025-10-29 17:02:25 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

[bugfix] Use custom bluemonday policy to disallow inline img tags (#2100)

Browse source
This commit is contained in:
tobi 2023-08-11 14:40:11 +02:00 • committed by GitHub
commit dc96562b40
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
17 changed files with 243 additions and 78 deletions
Download patch file Download diff file Expand all files Collapse all files

8
internal/processing/account/update.go
View file

@ -67,7 +67,7 @@ func (p *Processor) Update(ctx context.Context, account *gtsmodel.Account, form
}
// Parse new display name (always from plaintext).
account.DisplayName = text.SanitizePlaintext(displayName)
account.DisplayName = text.SanitizeToPlaintext(displayName)
// If display name has changed, account emojis may have also changed.
emojisChanged = true
@ -110,8 +110,8 @@ func (p *Processor) Update(ctx context.Context, account *gtsmodel.Account, form
// Sanitize raw field values.
fieldRaw := &gtsmodel.Field{
Name: text.SanitizePlaintext(name),
Value: text.SanitizePlaintext(value),
Name: text.SanitizeToPlaintext(name),
Value: text.SanitizeToPlaintext(value),
}
fieldsRaw = append(fieldsRaw, fieldRaw)
}
@ -255,7 +255,7 @@ func (p *Processor) Update(ctx context.Context, account *gtsmodel.Account, form
if err := validate.CustomCSS(customCSS); err != nil {
return nil, gtserror.NewErrorBadRequest(err, err.Error())
}
account.CustomCSS = text.SanitizePlaintext(customCSS)
account.CustomCSS = text.SanitizeToPlaintext(customCSS)
}
if form.EnableRSS != nil {