rainbownapkin/canopy
1
0
Fork 0
Code Issues 7 Pull requests Projects Releases Packages Wiki Activity Actions

Improved sanatization for server-side templating.

Browse source
This commit is contained in:
rainbow napkin 2025-11-04 06:09:26 -05:00
parent 35fd81e1b2
commit 08fe051269
30 changed files with 151 additions and 104 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/views/partial/channelSettings/info.ejs
View file

@ -19,13 +19,13 @@ along with this program. If not, see <https://www.gnu.org/licenses/>. %>
<span class="channel-info-span" id="channel-info-thumbnail-span">
<p class="channel-info-label">Thumbnail:</p>
<div>
<input value="<%= channel.thumbnail %>" placeholder="Thumbnail URL" style="display: none;" id="channel-info-thumbnail-prompt">
<img class="interactive" src="<%= channel.thumbnail %> " id="channel-info-thumbnail">
<input value="<%= encodeURI(unescape(channel.thumbnail)) %>" placeholder="Thumbnail URL" style="display: none;" id="channel-info-thumbnail-prompt">
<img class="interactive" src="<%= encodeURI(unescape(channel.thumbnail)) %> " id="channel-info-thumbnail">
</div>
</span>
<span class="channel-info-span" id="channel-info-description-span">
<p class="channel-info-label">Description:</p>
<p class="interactive" id="channel-info-description"><%= channel.description %></p>
<p class="interactive" id="channel-info-description"><%= unescape(channel.description) %></p>
<span>
</div>
</div>

7
src/views/partial/channelSettings/permList.ejs
View file

@ -20,10 +20,11 @@ along with this program. If not, see <https://www.gnu.org/licenses/>. %>
<% Object.keys(channel.permissions.toObject()).forEach((key)=>{ %>
<% if(key != "channelOverrides"){ %>
<span class="admin-list-field-container">
<label class="admin-list-label admin-perm-list" for="admin-perm-list-rank-select-<%- key %>"><%- key %>: </label>
<select data-key="<%- key %>" name="admin-perm-list-rank-select-<%- key %>" class="channel-perm-select admin-list-select admin-perm-list-rank-select">
<%# These strings are generated internally server-side. There really isn't much of a reason to sanatize them.%>
<label class="admin-list-label admin-perm-list" for="admin-perm-list-rank-select-<%= key %>"><%= key %>: </label>
<select data-key="<%= key %>" name="admin-perm-list-rank-select-<%= key %>" class="channel-perm-select admin-list-select admin-perm-list-rank-select">
<%rankEnum.slice().reverse().forEach((rank)=>{ %>
<option <%if(channel.permissions.toObject()[key] == rank){%> selected <%}%> value="<%- rank %>"><%- rank %></option>
<option <%if(channel.permissions.toObject()[key] == rank){%> selected <%}%> value="<%= rank %>"><%= rank %></option>
<% }); %>
</select>
</span>

6
src/views/partial/channelSettings/settings.ejs
View file

@ -19,13 +19,13 @@ along with this program. If not, see <https://www.gnu.org/licenses/>. %>
<form action="javascript:" class="admin-list-field">
<% Object.keys(channel.settings).forEach((key) => { %>
<span class="admin-list-field-container">
<label class="admin-list-label"><%- key %>:</label>
<label class="admin-list-label"><%= key %>:</label>
<% switch(typeof channel.settings[key]){
case "string": %>
<input data-key="<%- key %>" class="channel-preference-list-item" value="<%- channel.settings[key] %>">
<input data-key="<%= key %>" class="channel-preference-list-item" value="<%= channel.settings[key] %>">
<% break;
default: %>
<input data-key="<%- key %>" class="channel-preference-list-item" type="checkbox" <% if(channel.settings[key]){ %> checked <% } %>>
<input data-key="<%= key %>" class="channel-preference-list-item" type="checkbox" <% if(channel.settings[key]){ %> checked <% } %>>
<% break;
} %>
</span>