hamlab/mobilizon-frontend
2
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Correctly escape user-defined names in emails

Browse Source 
Closes #1151

Signed-off-by: Thomas Citharel <tcit@tcit.fr>
This commit is contained in:
Thomas Citharel
2022-10-31 13:00:45 +01:00
parent 695d773d50
commit 470a3e594b
28 changed files with 162 additions and 118 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
lib/service/metadata/event.ex
View File

@@ -9,15 +9,21 @@ defimpl Mobilizon.Service.Metadata, for: Mobilizon.Events.Event do
alias Mobilizon.Web.Router.Helpers, as: Routes
import Mobilizon.Service.Metadata.Utils,
only: [process_description: 2, strip_tags: 1, datetime_to_string: 2, render_address!: 1]
only: [
process_description: 2,
strip_tags: 1,
datetime_to_string: 2,
render_address!: 1,
escape_text: 1
]
def build_tags(%Event{} = event, locale \\ "en") do
formatted_description = description(event, locale)
tags = [
Tag.content_tag(:title, event.title <> " - Mobilizon"),
Tag.content_tag(:title, escape_text(event.title) <> " - Mobilizon"),
Tag.tag(:meta, name: "description", content: process_description(event.description, locale)),
Tag.tag(:meta, property: "og:title", content: event.title),
Tag.tag(:meta, property: "og:title", content: escape_text(event.title)),
Tag.tag(:meta, property: "og:url", content: event.url),
Tag.tag(:meta, property: "og:description", content: formatted_description),
Tag.tag(:meta, property: "og:type", content: "website"),
@@ -48,7 +54,7 @@ defimpl Mobilizon.Service.Metadata, for: Mobilizon.Events.Event do
%{
"@type" => "ListItem",
"position" => 1,
"name" => Actor.display_name(event.attributed_to),
"name" => event.attributed_to |> Actor.display_name() |> escape_text(),
"item" =>
Endpoint
|> Routes.page_url(
@@ -85,7 +91,7 @@ defimpl Mobilizon.Service.Metadata, for: Mobilizon.Events.Event do
%{
"@type" => "ListItem",
"position" => 2,
"name" => event.title
"name" => escape_text(event.title)
}
]
}