* expert-settings-and-serverside: (84 commits)
lint
Make media modal buttons larger
Add English translation for hide tooltip
Add hide button to media modal
Lint
Prevent hiding media viewer if swiped over SwipeClick
Fix webkit image blurs
Fix video in media modal not displaying properly
Add changelog for https://git.pleroma.social/pleroma/pleroma-fe/-/merge_requests/1403
Remove image box-shadow in media modal
Clean up debug code for image pinch zoom
Bump @kazvmoe-infra/pinch-zoom-element to 1.2.0 on npm
Bump pinch-zoom-element version
Clean up
Check whether we swiped only for mouse pointer
Scale swipe threshold with viewport width
Update pinch-zoom-element
Allow pinch-zoom to fill the whole screen
Use native click for hiding overlay
Reset position on swipe end even if we cannot navigate
...
* origin/develop: (83 commits)
Make media modal buttons larger
Add English translation for hide tooltip
Add hide button to media modal
Lint
Prevent hiding media viewer if swiped over SwipeClick
Fix webkit image blurs
Fix video in media modal not displaying properly
Add changelog for https://git.pleroma.social/pleroma/pleroma-fe/-/merge_requests/1403
Remove image box-shadow in media modal
Clean up debug code for image pinch zoom
Bump @kazvmoe-infra/pinch-zoom-element to 1.2.0 on npm
Bump pinch-zoom-element version
Clean up
Check whether we swiped only for mouse pointer
Scale swipe threshold with viewport width
Update pinch-zoom-element
Allow pinch-zoom to fill the whole screen
Use native click for hiding overlay
Reset position on swipe end even if we cannot navigate
Make lint happy
...
* expert-settings-and-serverside:
Update dependency shelljs to v0.8.5
Do not mute bot posts in notifications
Add bot indication to user icon on statuses
Mute bot posts
* origin/develop:
Update dependency v-click-outside to v2.1.5
Update dependency shelljs to v0.8.5
Update dependency portal-vue to v2.1.7
Update dependency lodash to v4.17.21
Update dependency karma-spec-reporter to v0.0.33
Update dependency karma-webpack to v4.0.2
Update dependency karma-sourcemap-loader to v0.3.8
Update dependency eslint-plugin-vue to v5.2.3
Update dependency chromedriver to v87.0.7
Update dependency @chenfengyuan/vue-qrcode to v1.0.2
Pin dependencies
Pin dependencies
Do not mute bot posts in notifications
Lint
Add renovate.json
Add bot indication to user icon on statuses
Mute bot posts
fix placeholder attachments opening new tab
* tusooa/from/develop/tusooa/tree-threading:
Add English translations for fading ancestor option
Make fading ancestors optional
Update English translation for tree view settings
Split conversation display style into two different settings
Make 'Show full conversation' button have left border in embbeded mode
Fix showingLongSubject not correctly propagated
Fix timeline jump when scrolling
Make replying and mediaPlaying controlled
Clean up debug code for tree threading
Fix virtual scrolling for tree threading
Fix controlled status display toggles
Add English translations for other replies count
Add other replies count for reply list link
Do not display replies inside status as link if there are no other replies
* expert-settings-and-serverside:
lint
pre-emptively wipe serverside settings on logout
fix errors in choicesetting
fix typos in profile page
hidden away more settings when logged out
fix settings behaving erratically and not updating properly
fix stripping rich content not working
revert changes related to streaming/firehose setting, reword it so it's not confused with websocket streaming
fix firefox rendering (??????????)
revert to using local setting for default nsfw since backend is broken
better phrasing
new defaults
expert settings toggle + server-side settings
* tusooa/from/develop/tusooa/tree-threading: (48 commits)
Fix showingLongSubject not correctly propagated
Fix timeline jump when scrolling
Make replying and mediaPlaying controlled
Clean up debug code for tree threading
Fix virtual scrolling for tree threading
Fix controlled status display toggles
Add English translations for other replies count
Add other replies count for reply list link
Add English translation for position of other replies button pref
Make position of other replies button a pref
Add English translation for show all conversation button improvement
Improve "show full conversation" interaction
Make other replies button stretch along the row
Optimise thread ancestor borders
Optimise thread ancestor display style
Reset thread open state when collapsed
Clean up
Highlight ancestor of the current status when diving back to top
Add English translation for Misskey-style tree view
Implement Misskey-style tree view
...
* fix-mentions-new-bugs:
fix amps in links
make chat messages behave same as posts for animated gifs
support width/height img attributes
lint
better phrasing?
options to disable (You)s and highlighting of yourself
fix poast mentions tripping
fix alignment issues
* origin/develop:
Fix lint warning in filtering_tab.vue
Fix Follow button missing on follow list
Hide mention link avatar by default
Add English translation for mention link prefs
Make mention link prefs ui more intuitive
Add option to fade domains in mention link
Make avatar unselectable
Add option to display user avatar in mention link
Make (You) unselectable
Style properly usernames without tooltips
Add pref for whether to display full user names and tooltips
Add a pref for whether to display mention as icon or text
* origin/develop:
Update CHANGELOG.md
undo accidental change when merging
Improve the user card for deactivated users
Update CHANGELOG.md
Update CHANGELOG.md
Apply 1 suggestion(s) to 1 file(s)
Allow canceling a follow request
Simple policy reasons for instance specific policies
Translated using Weblate (Spanish)
Translated using Weblate (Catalan)
Translated using Weblate (Korean)
Translated using Weblate (Japanese (ja_PEDANTIC))
Translated using Weblate (Indonesian)
Translated using Weblate (Esperanto)
Translated using Weblate (Vietnamese)
Translated using Weblate (Italian)
Translated using Weblate (Vietnamese)
Translated using Weblate (Indonesian)
Translated using Weblate (Italian)
* origin/develop: (169 commits)
Improve the user card for deactivated users
Update CHANGELOG.md
Update CHANGELOG.md
Allow canceling a follow request
Simple policy reasons for instance specific policies
entity_normalizer: Escape name when parsing user
Translated using Weblate (Spanish)
Translated using Weblate (Catalan)
Translated using Weblate (Korean)
Translated using Weblate (Japanese (ja_PEDANTIC))
Translated using Weblate (Indonesian)
Translated using Weblate (Esperanto)
Translated using Weblate (Vietnamese)
Translated using Weblate (Italian)
Translated using Weblate (Vietnamese)
Translated using Weblate (Indonesian)
Translated using Weblate (Italian)
Translated using Weblate (Vietnamese)
Translated using Weblate (Indonesian)
Translated using Weblate (Chinese (Simplified))
...
In January 2020 Pleroma backend stopped escaping HTML in display names
and passed that responsibility on frontends, compliant with Mastodon's
version of Mastodon API [1]. Pleroma-FE was subsequently modified to
escape the display name [2], however only in the "name_html" field. This
was fine however, since that's what the code rendering display names used.
However, 2 months ago an MR [3] refactoring the way the frontend does emoji
and mention rendering was merged. One of the things it did was moving away
from doing emoji rendering in the entity normalizer and use the unescaped
'user.name' in the rendering code, resulting in HTML injection being
possible again.
This patch escapes 'user.name' as well, as far as I can tell there is no
actual use for an unescaped display name in frontend code, especially
when it comes from MastoAPI, where it is not supposed to be HTML.
[1]: https://git.pleroma.social/pleroma/pleroma-fe/-/merge_requests/1052
[2]: https://git.pleroma.social/pleroma/pleroma/-/merge_requests/2167
[3]: https://git.pleroma.social/pleroma/pleroma-fe/-/merge_requests/1392
