hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

escaping summary and other fields in xml templates

Browse source
This commit is contained in:
Alexander Strizhakov 2020-11-10 10:44:22 +03:00
commit 0c68b9ac13
No known key found for this signature in database
GPG key ID: 022896A53AEF1381
4 changed files with 29 additions and 54 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/pleroma/web/feed/feed_view.ex
View file

@ -83,7 +83,7 @@ defmodule Pleroma.Web.Feed.FeedView do
def activity_content(_), do: ""
def activity_context(activity), do: activity.data["context"]
def activity_context(activity), do: escape(activity.data["context"])
def attachment_href(attachment) do
attachment["url"]

2
lib/pleroma/web/templates/feed/feed/_activity.atom.eex
View file

@ -12,7 +12,7 @@
<link href="<%= activity_context(@activity) %>" rel="ostatus:conversation"/>
<%= if @data["summary"] do %>
<summary><%= @data["summary"] %></summary>
<summary><%= escape(@data["summary"]) %></summary>
<% end %>
<%= if @activity.local do %>

2
lib/pleroma/web/templates/feed/feed/_activity.rss.eex
View file

@ -12,7 +12,7 @@
<link rel="ostatus:conversation"><%= activity_context(@activity) %></link>
<%= if @data["summary"] do %>
<description><%= @data["summary"] %></description>
<description><%= escape(@data["summary"]) %></description>
<% end %>
<%= if @activity.local do %>