From d0770dbbe1f263c5a3ba94646e0dd8c719fe7401 Mon Sep 17 00:00:00 2001 From: Jason McBrayer Date: Wed, 6 Jun 2018 15:21:00 -0400 Subject: [PATCH] Fix unescaping of html in template filters. This was not a security bug, because it was done before passing code to sanitize, but it was totally an annoying UI bug. --- brutaldon/templatetags/taglinks.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/brutaldon/templatetags/taglinks.py b/brutaldon/templatetags/taglinks.py index b495868..8b95256 100644 --- a/brutaldon/templatetags/taglinks.py +++ b/brutaldon/templatetags/taglinks.py @@ -2,9 +2,15 @@ from django import template from bs4 import BeautifulSoup from urllib import parse from django.urls import reverse +from pdb import set_trace register = template.Library() +@register.filter +def pdb(element): + set_trace() + return element + @register.filter def relink_tags(value): '''Treat the text as html, and replace tag links with app-internal tag links @@ -18,7 +24,7 @@ def relink_tags(value): soup = BeautifulSoup(value, 'html.parser') for link in soup.find_all('a', class_='hashtag'): link['href'] = reverse('tag', args=[link.span.string]) - return soup.decode(formatter=None) + return soup.decode(formatter='html') @register.filter def relink_mentions(value): @@ -39,7 +45,7 @@ def relink_mentions(value): link['href'] = reverse('user', args=[user+'@'+instance]) except: continue - return soup.decode(formatter=None) + return soup.decode(formatter='html') @register.filter def relink_toot(value):