Correctly escape user-defined names in emails

Closes #1151

Signed-off-by: Thomas Citharel <tcit@tcit.fr>
This commit is contained in:
Thomas Citharel 2022-10-31 13:00:45 +01:00
parent 695d773d50
commit 470a3e594b
No known key found for this signature in database
GPG key ID: A061B9DDE0CA0773
28 changed files with 162 additions and 118 deletions

View file

@ -5,7 +5,10 @@ defimpl Mobilizon.Service.Metadata, for: Mobilizon.Actors.Actor do
alias Mobilizon.Web.Endpoint
alias Mobilizon.Web.JsonLD.ObjectView
alias Mobilizon.Web.Router.Helpers, as: Routes
import Mobilizon.Service.Metadata.Utils, only: [process_description: 2, default_description: 1]
import Mobilizon.Service.Metadata.Utils,
only: [process_description: 2, default_description: 1, escape_text: 1]
import Mobilizon.Web.Gettext
def build_tags(_actor, _locale \\ "en")
@ -19,7 +22,7 @@ defimpl Mobilizon.Service.Metadata, for: Mobilizon.Actors.Actor do
end)
[
Tag.tag(:meta, property: "og:title", content: Actor.display_name_and_username(group)),
Tag.tag(:meta, property: "og:title", content: actor_display_name_escaped(group)),
Tag.tag(:meta,
property: "og:url",
content:
@ -34,7 +37,7 @@ defimpl Mobilizon.Service.Metadata, for: Mobilizon.Actors.Actor do
Tag.tag(:meta, property: "og:type", content: "profile"),
Tag.tag(:meta,
property: "profile:username",
content: Actor.preferred_username_and_domain(group)
content: group |> Actor.preferred_username_and_domain() |> escape_text()
),
Tag.tag(:meta, property: "twitter:card", content: "summary"),
Tag.tag(:meta, property: "twitter:site", content: "@joinmobilizon")
@ -67,7 +70,7 @@ defimpl Mobilizon.Service.Metadata, for: Mobilizon.Actors.Actor do
%{
"@type" => "ListItem",
"position" => 1,
"name" => Actor.display_name(group)
"name" => actor_display_name_escaped(group)
}
]
}
@ -87,16 +90,14 @@ defimpl Mobilizon.Service.Metadata, for: Mobilizon.Actors.Actor do
Tag.tag(:link,
rel: "alternate",
type: "application/atom+xml",
title:
gettext("%{name}'s feed", name: group.name || group.preferred_username) |> HTML.raw(),
title: gettext("%{name}'s feed", name: actor_display_name_escaped(group)) |> HTML.raw(),
href:
Routes.feed_url(Endpoint, :actor, Actor.preferred_username_and_domain(group), :atom)
),
Tag.tag(:link,
rel: "alternate",
type: "text/calendar",
title:
gettext("%{name}'s feed", name: group.name || group.preferred_username) |> HTML.raw(),
title: gettext("%{name}'s feed", name: actor_display_name_escaped(group)) |> HTML.raw(),
href:
Routes.feed_url(
Endpoint,
@ -131,4 +132,10 @@ defimpl Mobilizon.Service.Metadata, for: Mobilizon.Actors.Actor do
|> ObjectView.render(%{group: group})
|> Jason.encode!()
end
defp actor_display_name_escaped(actor) do
actor
|> Actor.display_name()
|> escape_text()
end
end

View file

@ -1,11 +1,13 @@
defimpl Mobilizon.Service.Metadata, for: Mobilizon.Discussions.Comment do
alias Phoenix.HTML.Tag
alias Mobilizon.Actors.Actor
alias Mobilizon.Discussions.Comment
import Mobilizon.Service.Metadata.Utils, only: [escape_text: 1]
@spec build_tags(Comment.t(), String.t()) :: list(Phoenix.HTML.safe())
def build_tags(%Comment{deleted_at: nil} = comment, _locale) do
[
Tag.tag(:meta, property: "og:title", content: comment.actor.preferred_username),
Tag.tag(:meta, property: "og:title", content: escape_text(Actor.display_name(comment.actor))),
Tag.tag(:meta, property: "og:url", content: comment.url),
Tag.tag(:meta, property: "og:description", content: comment.text),
Tag.tag(:meta, property: "og:type", content: "website"),

View file

@ -9,15 +9,21 @@ defimpl Mobilizon.Service.Metadata, for: Mobilizon.Events.Event do
alias Mobilizon.Web.Router.Helpers, as: Routes
import Mobilizon.Service.Metadata.Utils,
only: [process_description: 2, strip_tags: 1, datetime_to_string: 2, render_address!: 1]
only: [
process_description: 2,
strip_tags: 1,
datetime_to_string: 2,
render_address!: 1,
escape_text: 1
]
def build_tags(%Event{} = event, locale \\ "en") do
formatted_description = description(event, locale)
tags = [
Tag.content_tag(:title, event.title <> " - Mobilizon"),
Tag.content_tag(:title, escape_text(event.title) <> " - Mobilizon"),
Tag.tag(:meta, name: "description", content: process_description(event.description, locale)),
Tag.tag(:meta, property: "og:title", content: event.title),
Tag.tag(:meta, property: "og:title", content: escape_text(event.title)),
Tag.tag(:meta, property: "og:url", content: event.url),
Tag.tag(:meta, property: "og:description", content: formatted_description),
Tag.tag(:meta, property: "og:type", content: "website"),
@ -48,7 +54,7 @@ defimpl Mobilizon.Service.Metadata, for: Mobilizon.Events.Event do
%{
"@type" => "ListItem",
"position" => 1,
"name" => Actor.display_name(event.attributed_to),
"name" => event.attributed_to |> Actor.display_name() |> escape_text(),
"item" =>
Endpoint
|> Routes.page_url(
@ -85,7 +91,7 @@ defimpl Mobilizon.Service.Metadata, for: Mobilizon.Events.Event do
%{
"@type" => "ListItem",
"position" => 2,
"name" => event.title
"name" => escape_text(event.title)
}
]
}

View file

@ -7,14 +7,16 @@ defimpl Mobilizon.Service.Metadata, for: Mobilizon.Posts.Post do
alias Mobilizon.Web.Endpoint
alias Mobilizon.Web.JsonLD.ObjectView
alias Mobilizon.Web.Router.Helpers, as: Routes
import Mobilizon.Service.Metadata.Utils, only: [process_description: 2, strip_tags: 1]
import Mobilizon.Service.Metadata.Utils,
only: [process_description: 2, strip_tags: 1, escape_text: 1]
def build_tags(%Post{} = post, locale \\ "en") do
post = Map.put(post, :body, process_description(post.body, locale))
tags =
[
Tag.tag(:meta, property: "og:title", content: post.title),
Tag.tag(:meta, property: "og:title", content: escape_text(post.title)),
Tag.tag(:meta, property: "og:url", content: post.url),
Tag.tag(:meta, property: "og:description", content: post.body),
Tag.tag(:meta, property: "og:type", content: "article"),
@ -31,7 +33,7 @@ defimpl Mobilizon.Service.Metadata, for: Mobilizon.Posts.Post do
%{
"@type" => "ListItem",
"position" => 1,
"name" => Actor.display_name(post.attributed_to),
"name" => post.attributed_to |> Actor.display_name() |> escape_text,
"item" =>
Endpoint
|> Routes.page_url(

View file

@ -74,4 +74,11 @@ defmodule Mobilizon.Service.Metadata.Utils do
@spec stringify_tag(String.t(), String.t()) :: String.t()
defp stringify_tag(tag, acc) when is_binary(tag), do: acc <> tag
@spec escape_text(String.t()) :: String.t()
def escape_text(text) do
text
|> HTML.html_escape()
|> HTML.safe_to_string()
end
end

View file

@ -1,35 +1,35 @@
<%= case @activity.subject do %>
<% :event_comment_mention -> %>
<%= dgettext("activity", "%{profile} mentionned you in a comment under event %{event}.", %{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
event:
"<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
:event,
@activity.subject_params["event_uuid"]) |> URI.decode()}\">
#{@activity.subject_params["event_title"]}
#{escape_html(@activity.subject_params["event_title"])}
</a>"
})
|> raw %>
<% :participation_event_comment -> %>
<%= dgettext("activity", "%{profile} has posted an announcement under event %{event}.", %{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
event:
"<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
:event,
@activity.subject_params["event_uuid"]) |> URI.decode()}\">
#{@activity.subject_params["event_title"]}
#{escape_html(@activity.subject_params["event_title"])}
</a>"
})
|> raw %>
<% :event_new_comment -> %>
<%= if @activity.subject_params["comment_reply_to"] do %>
<%= dgettext("activity", "%{profile} has posted a new reply under your event %{event}.", %{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
event:
"<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
:event,
@activity.subject_params["event_uuid"]) |> URI.decode()}#comment-#{@activity.subject_params["comment_reply_to_uuid"]}-#{@activity.subject_params["comment_uuid"]}\">
#{@activity.subject_params["event_title"]}
#{escape_html(@activity.subject_params["event_title"])}
</a>"
})
|> raw %>
@ -38,12 +38,12 @@
"activity",
"%{profile} has posted a new comment under your event %{event}.",
%{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
event:
"<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
:event,
@activity.subject_params["event_uuid"]) |> URI.decode()}#comment-#{@activity.subject_params["comment_uuid"]}\">
#{@activity.subject_params["event_title"]}
#{escape_html(@activity.subject_params["event_title"])}
</a>"
}
)

View file

@ -1,40 +1,40 @@
<%= case @activity.subject do %>
<% :discussion_created -> %>
<%= dgettext("activity", "%{profile} created the discussion %{discussion}.", %{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
discussion:
"<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint, :discussion, Mobilizon.Actors.Actor.preferred_username_and_domain(@activity.group), @activity.subject_params["discussion_slug"]) |> URI.decode()}\">
#{@activity.subject_params["discussion_title"]}</a>"
#{escape_html(@activity.subject_params["discussion_title"])}</a>"
})
|> raw %>
<% :discussion_replied -> %>
<%= dgettext("activity", "%{profile} replied to the discussion %{discussion}.", %{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
discussion:
"<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint, :discussion, Mobilizon.Actors.Actor.preferred_username_and_domain(@activity.group), @activity.subject_params["discussion_slug"]) |> URI.decode()}\">
#{@activity.subject_params["discussion_title"]}</a>"
#{escape_html(@activity.subject_params["discussion_title"])}</a>"
})
|> raw %>
<% :discussion_renamed -> %>
<%= dgettext("activity", "%{profile} renamed the discussion %{discussion}.", %{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
discussion:
"<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint, :discussion, Mobilizon.Actors.Actor.preferred_username_and_domain(@activity.group), @activity.subject_params["discussion_slug"]) |> URI.decode()}\">
#{@activity.subject_params["discussion_title"]}</a>"
#{escape_html(@activity.subject_params["discussion_title"])}</a>"
})
|> raw %>
<% :discussion_archived -> %>
<%= dgettext("activity", "%{profile} archived the discussion %{discussion}.", %{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
discussion:
"<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint, :discussion, Mobilizon.Actors.Actor.preferred_username_and_domain(@activity.group), @activity.subject_params["discussion_slug"]) |> URI.decode()}\">
#{@activity.subject_params["discussion_title"]}</a>"
#{escape_html(@activity.subject_params["discussion_title"])}</a>"
})
|> raw %>
<% :discussion_deleted -> %>
<%= dgettext("activity", "%{profile} deleted the discussion %{discussion}.", %{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
discussion: "<b>#{@activity.subject_params["discussion_title"]}</b>"
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
discussion: "<b>#{escape_html(@activity.subject_params["discussion_title"])}</b>"
})
|> raw %>
<% end %>

View file

@ -1,52 +1,52 @@
<%= case @activity.subject do %>
<% :event_created -> %>
<%= dgettext("activity", "The event %{event} was created by %{profile}.", %{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
event:
"<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
:event,
@activity.subject_params["event_uuid"]) |> URI.decode()}\">
#{@activity.subject_params["event_title"]}
#{escape_html(@activity.subject_params["event_title"])}
</a>"
})
|> raw %>
<% :event_updated -> %>
<%= dgettext("activity", "The event %{event} was updated by %{profile}.", %{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
event:
"<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
:event,
@activity.subject_params["event_uuid"]) |> URI.decode()}\">
#{@activity.subject_params["event_title"]}
#{escape_html(@activity.subject_params["event_title"])}
</a>"
})
|> raw %>
<% :event_deleted -> %>
<%= dgettext("activity", "The event %{event} was deleted by %{profile}.", %{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
event: "<b>#{@activity.subject_params["event_title"]}</b>"
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
event: "<b>#{escape_html(@activity.subject_params["event_title"])}</b>"
})
|> raw %>
<% :comment_posted -> %>
<%= if @activity.subject_params["comment_reply_to"] do %>
<%= dgettext("activity", "%{profile} replied to a comment on the event %{event}.", %{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
event:
"<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
:event,
@activity.subject_params["event_uuid"]) |> URI.decode()}\">
#{@activity.subject_params["event_title"]}
#{escape_html(@activity.subject_params["event_title"])}
</a>"
})
|> raw %>
<% else %>
<%= dgettext("activity", "%{profile} posted a comment on the event %{event}.", %{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
event:
"<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
:event,
@activity.subject_params["event_uuid"]) |> URI.decode()}\">
#{@activity.subject_params["event_title"]}
#{escape_html(@activity.subject_params["event_title"])}
</a>"
})
|> raw %>

View file

@ -1,23 +1,23 @@
<%= case @activity.subject do %>
<% :group_created -> %>
<%= dgettext("activity", "%{profile} created the group %{group}.", %{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
group:
"<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
:actor,
@activity.subject_params["group_federated_username"]) |> URI.decode()}\">
#{@activity.subject_params["group_name"]}
#{escape_html(@activity.subject_params["group_name"])}
</a>"
})
|> raw %>
<% :group_updated -> %>
<%= dgettext("activity", "%{profile} updated the group %{group}.", %{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
group:
"<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
:actor,
@activity.subject_params["group_federated_username"]) |> URI.decode()}\">
#{@activity.subject_params["group_name"]}
#{escape_html(@activity.subject_params["group_name"])}
</a>"
})
|> raw %>

View file

@ -1,58 +1,58 @@
<%= case @activity.subject do %>
<% :member_request -> %>
<%= dgettext("activity", "%{member} requested to join the group.", %{
member: "<b>#{@activity.subject_params["member_actor_name"]}</b>"
member: "<b>#{escape_html(@activity.subject_params["member_actor_name"])}</b>"
})
|> raw %>
<% :member_invited -> %>
<%= dgettext("activity", "%{member} was invited by %{profile}.", %{
member: "<b>#{@activity.subject_params["member_actor_name"]}</b>",
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>"
member: "<b>#{escape_html(@activity.subject_params["member_actor_name"])}</b>",
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>"
})
|> raw %>
<% :member_accepted_invitation -> %>
<%= dgettext("activity", "%{member} accepted the invitation to join the group.", %{
member: "<b>#{@activity.subject_params["member_actor_name"]}</b>"
member: "<b>#{escape_html(@activity.subject_params["member_actor_name"])}</b>"
})
|> raw %>
<% :member_rejected_invitation -> %>
<%= dgettext("activity", "%{member} rejected the invitation to join the group.", %{
member: "<b>#{@activity.subject_params["member_actor_name"]}</b>"
member: "<b>#{escape_html(@activity.subject_params["member_actor_name"])}</b>"
})
|> raw %>
<% :member_joined -> %>
<%= dgettext("activity", "%{member} joined the group.", %{
member:
"<b title=\"#{@activity.subject_params["member_actor_federated_username"]}\">#{@activity.subject_params["member_actor_name"]}</b>"
"<b title=\"#{@activity.subject_params["member_actor_federated_username"]}\">#{escape_html(@activity.subject_params["member_actor_name"])}</b>"
})
|> raw %>
<% :member_added -> %>
<%= dgettext("activity", "%{profile} added the member %{member}.", %{
member: "<b>#{@activity.subject_params["member_actor_name"]}</b>",
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>"
member: "<b>#{escape_html(@activity.subject_params["member_actor_name"])}</b>",
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>"
})
|> raw %>
<% :member_approved -> %>
<%= dgettext("activity", "%{profile} approved the member %{member}.", %{
member: "<b>#{@activity.subject_params["member_actor_name"]}</b>",
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>"
member: "<b>#{escape_html(@activity.subject_params["member_actor_name"])}</b>",
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>"
})
|> raw %>
<% :member_updated -> %>
<%= dgettext("activity", "%{profile} updated the member %{member}.", %{
member: "<b>#{@activity.subject_params["member_actor_name"]}</b>",
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>"
member: "<b>#{escape_html(@activity.subject_params["member_actor_name"])}</b>",
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>"
})
|> raw %>
<% :member_removed -> %>
<%= dgettext("activity", "%{profile} excluded member %{member}.", %{
member: "<b>#{@activity.subject_params["member_actor_name"]}</b>",
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>"
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>"
})
|> raw %>
<% :member_quit -> %>
<%= dgettext("activity", "%{profile} quit the group.", %{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>"
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>"
})
|> raw %>
<% end %>

View file

@ -1,30 +1,30 @@
<%= case @activity.subject do %>
<% :post_created -> %>
<%= dgettext("activity", "The post %{post} was created by %{profile}.", %{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
post:
"<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
:post,
@activity.subject_params["post_slug"]) |> URI.decode()}\">
#{@activity.subject_params["post_title"]}
#{escape_html(@activity.subject_params["post_title"])}
</a>"
})
|> raw %>
<% :post_updated -> %>
<%= dgettext("activity", "The post %{post} was updated by %{profile}.", %{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
post:
"<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
:post,
@activity.subject_params["post_slug"]) |> URI.decode()}\">
#{@activity.subject_params["post_title"]}
#{escape_html(@activity.subject_params["post_title"])}
</a>"
})
|> raw %>
<% :post_deleted -> %>
<%= dgettext("activity", "The post %{post} was deleted by %{profile}.", %{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
post: "<b>#{@activity.subject_params["post_title"]}</b>"
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
post: "<b>#{escape_html(@activity.subject_params["post_title"])}</b>"
})
|> raw %>
<% end %>

View file

@ -2,23 +2,23 @@
<% :resource_created -> %>
<%= if @activity.subject_params["is_folder"] do %>
<%= dgettext("activity", "%{profile} created the folder %{resource}.", %{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
resource:
"<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
:resource,
@activity.subject_params["resource_uuid"]) |> URI.decode()}\">
#{@activity.subject_params["resource_title"]}
#{escape_html(@activity.subject_params["resource_title"])}
</a>"
})
|> raw %>
<% else %>
<%= dgettext("activity", "%{profile} created the resource %{resource}.", %{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
resource:
"<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
:resource,
@activity.subject_params["resource_uuid"]) |> URI.decode()}\">
#{@activity.subject_params["resource_title"]}
#{escape_html(@activity.subject_params["resource_title"])}
</a>"
})
|> raw %>
@ -29,14 +29,15 @@
"activity",
"%{profile} renamed the folder from %{old_resource_title} to %{resource}.",
%{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
resource:
"<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
:resource,
@activity.subject_params["resource_uuid"]) |> URI.decode()}\">
#{@activity.subject_params["resource_title"]}
#{escape_html(@activity.subject_params["resource_title"])}
</a>",
old_resource_title: "<b>#{@activity.subject_params["old_resource_title"]}</b>"
old_resource_title:
"<b>#{escape_html(@activity.subject_params["old_resource_title"])}</b>"
}
)
|> raw %>
@ -45,14 +46,15 @@
"activity",
"%{profile} renamed the resource from %{old_resource_title} to %{resource}.",
%{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
resource:
"<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
:resource,
@activity.subject_params["resource_uuid"]) |> URI.decode()}\">
#{@activity.subject_params["resource_title"]}
#{escape_html(@activity.subject_params["resource_title"])}
</a>",
old_resource_title: "<b>#{@activity.subject_params["old_resource_title"]}</b>"
old_resource_title:
"<b>#{escape_html(@activity.subject_params["old_resource_title"])}</b>"
}
)
|> raw %>
@ -60,23 +62,23 @@
<% :resource_moved -> %>
<%= if @activity.subject_params["is_folder"] do %>
<%= dgettext("activity", "%{profile} moved the folder %{resource}.", %{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
resource:
"<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
:resource,
@activity.subject_params["resource_uuid"]) |> URI.decode()}\">
#{@activity.subject_params["resource_title"]}
#{escape_html(@activity.subject_params["resource_title"])}
</a>"
})
|> raw %>
<% else %>
<%= dgettext("activity", "%{profile} moved the resource %{resource}.", %{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
resource:
"<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
:resource,
@activity.subject_params["resource_uuid"]) |> URI.decode()}\">
#{@activity.subject_params["resource_title"]}
#{escape_html(@activity.subject_params["resource_title"])}
</a>"
})
|> raw %>
@ -84,14 +86,14 @@
<% :resource_deleted -> %>
<%= if @activity.subject_params["is_folder"] do %>
<%= dgettext("activity", "%{profile} deleted the folder %{resource}.", %{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
resource: "<b>#{@activity.subject_params["resource_title"]}</b>"
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
resource: "<b>#{escape_html(@activity.subject_params["resource_title"])}</b>"
})
|> raw %>
<% else %>
<%= dgettext("activity", "%{profile} deleted the resource %{resource}.", %{
profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
resource: "<b>#{@activity.subject_params["resource_title"]}</b>"
profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
resource: "<b>#{escape_html(@activity.subject_params["resource_title"])}</b>"
})
|> raw %>
<% end %>

View file

@ -46,7 +46,7 @@
<p style="margin: 0;">
<%= gettext(
"Hi there! You just registered to join this event: « <b>%{title}</b> ». Please confirm the e-mail address you provided:",
title: @participant.event.title
title: escape_html(@participant.event.title)
)
|> raw %>
</p>

View file

@ -109,7 +109,7 @@
<%= gettext("This is a demonstration site to test Mobilizon.") %>
</p>
<p style="margin: 0; color: #3A384C;">
<%= gettext("<b>Please do not use it for real purposes.</b>") |> raw() %>
<b><%= gettext("Please do not use it for real purposes.") %></b>
</p>
</td>
</tr>

View file

@ -49,13 +49,12 @@
"activity",
"%{profile} has posted an announcement under event %{event}.",
%{
profile:
"<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
profile: "<b>#{escape_html(display_name_and_username(@activity.author))}</b>",
event:
"<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
:event,
@activity.subject_params["event_uuid"]) |> URI.decode()}\">
#{@activity.subject_params["event_title"]}
#{escape_html(@activity.subject_params["event_title"])}
</a>"
}
)

View file

@ -44,7 +44,9 @@
style="padding: 20px 30px 0px 30px; color: #474467; font-family: 'Roboto', Helvetica, Arial, sans-serif; font-size: 18px; font-weight: 400; line-height: 25px;"
>
<p style="margin: 0;">
<%= gettext("You recently requested to attend <b>%{title}</b>.", title: @event.title)
<%= gettext("You recently requested to attend <b>%{title}</b>.",
title: escape_html(@event.title)
)
|> raw %>
</p>
</td>

View file

@ -44,7 +44,9 @@
style="padding: 20px 30px 0px 30px; color: #474467; font-family: 'Roboto', Helvetica, Arial, sans-serif; font-size: 18px; font-weight: 400; line-height: 25px;"
>
<p style="margin: 0;">
<%= gettext("You recently requested to attend <b>%{title}</b>.", title: @event.title)
<%= gettext("You recently requested to attend <b>%{title}</b>.",
title: escape_html(@event.title)
)
|> raw %>
</p>
</td>

View file

@ -44,7 +44,9 @@
style="padding: 20px 30px 0px 30px; color: #474467; font-family: 'Roboto', Helvetica, Arial, sans-serif; font-size: 18px; font-weight: 400; line-height: 25px;"
>
<p style="margin: 0;">
<%= gettext("You issued a request to attend <b>%{title}</b>.", title: @event.title)
<%= gettext("You issued a request to attend <b>%{title}</b>.",
title: escape_html(@event.title)
)
|> raw %>
</p>
</td>

View file

@ -46,7 +46,7 @@
<p style="margin: 0;">
<%= gettext(
"There have been changes for <b>%{title}</b> so we'd thought we'd let you know.",
title: @old_event.title
title: escape_html(@old_event.title)
)
|> raw %>
</p>

View file

@ -46,8 +46,8 @@
<p style="margin: 0;">
<%= gettext(
"<b>%{inviter}</b> just invited you to join their group %{link_start}<b>%{group}</b>%{link_end}",
group: @group.name,
inviter: @inviter.name,
group: escape_html(display_name(@group)),
inviter: escape_html(display_name(@inviter)),
link_start: "<a href=\"#{@group.url}\">",
link_end: "</a>"
)

View file

@ -46,7 +46,7 @@
<p style="margin: 0;">
<%= gettext(
"You have been removed from group %{link_start}<b>%{group}</b>%{link_end}. You will not be able to access this group's private content anymore.",
group: @group.name,
group: escape_html(display_name(@group)),
link_start: "<a href=\"#{@group.url}\">",
link_end: "</a>"
)

View file

@ -46,9 +46,9 @@
<p style="margin: 0;">
<%= gettext(
"Your membership request for group %{link_start}<b>%{group}</b>%{link_end} has been approved.",
group: Mobilizon.Actors.Actor.display_name(@group),
group: escape_html(display_name(@group)),
link_start:
"<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint, :actor, Mobilizon.Actors.Actor.preferred_username_and_domain(@group)) |> URI.decode()}\">",
"<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint, :actor, preferred_username_and_domain(@group)) |> URI.decode()}\">",
link_end: "</a>"
)
|> raw %>

View file

@ -46,9 +46,9 @@
<p style="margin: 0;">
<%= gettext(
"Your membership request for group %{link_start}<b>%{group}</b>%{link_end} has been rejected.",
group: Mobilizon.Actors.Actor.display_name(@group),
group: escape_html(display_name(@group)),
link_start:
"<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint, :actor, Mobilizon.Actors.Actor.preferred_username_and_domain(@group)) |> URI.decode()}\">",
"<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint, :actor, preferred_username_and_domain(@group)) |> URI.decode()}\">",
link_end: "</a>"
)
|> raw %>

View file

@ -16,7 +16,7 @@
>
<h1 style="font-size: 48px; font-weight: 400; margin: 0;">
<%= gettext("The group %{group} has been suspended on %{instance}!",
group: @group.name || @group.preferred_username,
group: display_name(@group),
instance: @instance_name
) %>
</h1>
@ -49,12 +49,8 @@
<p style="margin: 0;">
<%= gettext(
"Your instance's moderation team has decided to suspend <b>%{group_name}</b> (%{group_address}). You are no longer a member of this group.",
group_name: @group.name,
group_address:
if(@group.domain,
do: "@#{@group.preferred_username}@#{@group.domain}",
else: "@#{@group.preferred_username}"
)
group_name: escape_html(display_name(@group)),
group_address: preferred_username_and_domain(@group)
)
|> raw %>
</p>

View file

@ -45,7 +45,7 @@
>
<p style="margin: 0;">
<%= gettext("<b>%{name}</b> just requested to follow your instance.",
name: Mobilizon.Actors.Actor.display_name_and_username(@follower)
name: escape_html(display_name_and_username(@follower))
)
|> raw %>
<br />
@ -67,7 +67,7 @@
<p style="margin: 0;">
<%= gettext(
"Note: %{name} following you doesn't necessarily imply that you follow this instance, but you can ask to follow them too.",
name: Mobilizon.Actors.Actor.display_name_and_username(@follower)
name: escape_html(display_name_and_username(@follower))
) %>
</p>
</td>

View file

@ -47,12 +47,12 @@
<%= if @report.reporter.type == :Application and @report.reporter.preferred_username == "relay" do %>
<%= gettext(
"Someone on <b>%{instance}</b> reported the following content for you to analyze:",
instance: @report.reporter.domain
instance: escape_html(@report.reporter.domain)
)
|> raw %>
<% else %>
<%= gettext("<b>%{reporter}</b> reported the following content.",
reporter: Mobilizon.Actors.Actor.display_name_and_username(@report.reporter)
reporter: escape_html(display_name_and_username(@report.reporter))
)
|> raw %>
<% end %>

View file

@ -4,12 +4,13 @@ defmodule Mobilizon.Web.EmailView do
pattern: "**/*",
namespace: Mobilizon.Web
alias Mobilizon.Actors.Actor
alias Mobilizon.Service.Address
alias Mobilizon.Service.DateTime, as: DateTimeRenderer
alias Mobilizon.Web.Router.Helpers, as: Routes
import Mobilizon.Web.Gettext
import Mobilizon.Service.Metadata.Utils, only: [process_description: 1]
import Phoenix.HTML, only: [raw: 1]
import Phoenix.HTML, only: [raw: 1, html_escape: 1, safe_to_string: 1]
defdelegate datetime_to_string(datetime, locale \\ "en", format \\ :medium),
to: DateTimeRenderer
@ -24,4 +25,20 @@ defmodule Mobilizon.Web.EmailView do
defdelegate datetime_relative(datetime, locale \\ "en"), to: DateTimeRenderer
defdelegate render_address(address), to: Address
defdelegate is_same_day?(one, two), to: DateTimeRenderer
defdelegate display_name_and_username(actor), to: Actor
defdelegate display_name(actor), to: Actor
defdelegate preferred_username_and_domain(actor), to: Actor
@spec escape_html(String.t()) :: String.t()
def escape_html(string) do
string
|> html_escape()
|> safe_to_string()
end
def escaped_display_name_and_username(actor) do
actor
|> Actor.display_name_and_username()
|> escape_html()
end
end

View file

@ -18,7 +18,7 @@ defmodule Mobilizon.Service.MetadataTest do
assert group |> Metadata.build_tags() |> Metadata.Utils.stringify_tags() ==
String.trim("""
<meta content="#{group.name} (@#{group.preferred_username}@#{group.domain})" property="og:title"><meta content="#{URI.decode(Routes.page_url(Endpoint, :actor, Actor.preferred_username_and_domain(group)))}" property="og:url"><meta content="The event organizer didn&#39;t add any description." property="og:description"><meta content="profile" property="og:type"><meta content="#{Actor.preferred_username_and_domain(group)}" property="profile:username"><meta content="summary" property="twitter:card"><meta content="@joinmobilizon" property="twitter:site"><meta content="#{group.avatar.url}" property="og:image"><script type="application/ld+json">{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","name":"#{group.name}","position":1}]}</script><script type="application/ld+json">{"@context":"http://schema.org","@type":"Organization","address":{"@type":"PostalAddress","addressCountry":"My Country","addressLocality":"My Locality","addressRegion":"My Region","postalCode":"My Postal Code","streetAddress":"My Street Address"},"image":"#{group.banner.url}","name":"#{group.name}","url":"#{group.url}"}</script><link href="#{Routes.feed_url(Endpoint, :actor, Actor.preferred_username_and_domain(group), "atom")}" rel="alternate" title="#{group.name}'s feed" type="application/atom+xml"><link href="#{Routes.feed_url(Endpoint, :actor, Actor.preferred_username_and_domain(group), "ics")}" rel="alternate" title="#{group.name}'s feed" type="text/calendar"><link href="#{group.url}" rel="alternate" type="application/activity+json"><link href="#{group.url}" rel="canonical"><meta content="noindex" name="robots">
<meta content="#{group.name}" property="og:title"><meta content="#{URI.decode(Routes.page_url(Endpoint, :actor, Actor.preferred_username_and_domain(group)))}" property="og:url"><meta content="The event organizer didn&#39;t add any description." property="og:description"><meta content="profile" property="og:type"><meta content="#{Actor.preferred_username_and_domain(group)}" property="profile:username"><meta content="summary" property="twitter:card"><meta content="@joinmobilizon" property="twitter:site"><meta content="#{group.avatar.url}" property="og:image"><script type="application/ld+json">{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","name":"#{group.name}","position":1}]}</script><script type="application/ld+json">{"@context":"http://schema.org","@type":"Organization","address":{"@type":"PostalAddress","addressCountry":"My Country","addressLocality":"My Locality","addressRegion":"My Region","postalCode":"My Postal Code","streetAddress":"My Street Address"},"image":"#{group.banner.url}","name":"#{group.name}","url":"#{group.url}"}</script><link href="#{Routes.feed_url(Endpoint, :actor, Actor.preferred_username_and_domain(group), "atom")}" rel="alternate" title="#{group.name}'s feed" type="application/atom+xml"><link href="#{Routes.feed_url(Endpoint, :actor, Actor.preferred_username_and_domain(group), "ics")}" rel="alternate" title="#{group.name}'s feed" type="text/calendar"><link href="#{group.url}" rel="alternate" type="application/activity+json"><link href="#{group.url}" rel="canonical"><meta content="noindex" name="robots">
""")
assert group
@ -26,7 +26,7 @@ defmodule Mobilizon.Service.MetadataTest do
|> Metadata.build_tags()
|> Metadata.Utils.stringify_tags() ==
String.trim("""
<meta content="#{group.name} (@#{group.preferred_username}@#{group.domain})" property="og:title"><meta content="#{URI.decode(Routes.page_url(Endpoint, :actor, Actor.preferred_username_and_domain(group)))}" property="og:url"><meta content="The event organizer didn&#39;t add any description." property="og:description"><meta content="profile" property="og:type"><meta content="#{Actor.preferred_username_and_domain(group)}" property="profile:username"><meta content="summary" property="twitter:card"><meta content="@joinmobilizon" property="twitter:site"><script type="application/ld+json">{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","name":"#{group.name}","position":1}]}</script><script type="application/ld+json">{"@context":"http://schema.org","@type":"Organization","address":{"@type":"PostalAddress","addressCountry":"My Country","addressLocality":"My Locality","addressRegion":"My Region","postalCode":"My Postal Code","streetAddress":"My Street Address"},"image":"#{group.banner.url}","name":"#{group.name}","url":"#{group.url}"}</script><link href="#{Routes.feed_url(Endpoint, :actor, Actor.preferred_username_and_domain(group), "atom")}" rel="alternate" title="#{group.name}'s feed" type="application/atom+xml"><link href="#{Routes.feed_url(Endpoint, :actor, Actor.preferred_username_and_domain(group), "ics")}" rel="alternate" title="#{group.name}'s feed" type="text/calendar"><link href="#{group.url}" rel="alternate" type="application/activity+json"><link href="#{group.url}" rel="canonical"><meta content="noindex" name="robots">
<meta content="#{group.name}" property="og:title"><meta content="#{URI.decode(Routes.page_url(Endpoint, :actor, Actor.preferred_username_and_domain(group)))}" property="og:url"><meta content="The event organizer didn&#39;t add any description." property="og:description"><meta content="profile" property="og:type"><meta content="#{Actor.preferred_username_and_domain(group)}" property="profile:username"><meta content="summary" property="twitter:card"><meta content="@joinmobilizon" property="twitter:site"><script type="application/ld+json">{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","name":"#{group.name}","position":1}]}</script><script type="application/ld+json">{"@context":"http://schema.org","@type":"Organization","address":{"@type":"PostalAddress","addressCountry":"My Country","addressLocality":"My Locality","addressRegion":"My Region","postalCode":"My Postal Code","streetAddress":"My Street Address"},"image":"#{group.banner.url}","name":"#{group.name}","url":"#{group.url}"}</script><link href="#{Routes.feed_url(Endpoint, :actor, Actor.preferred_username_and_domain(group), "atom")}" rel="alternate" title="#{group.name}'s feed" type="application/atom+xml"><link href="#{Routes.feed_url(Endpoint, :actor, Actor.preferred_username_and_domain(group), "ics")}" rel="alternate" title="#{group.name}'s feed" type="text/calendar"><link href="#{group.url}" rel="alternate" type="application/activity+json"><link href="#{group.url}" rel="canonical"><meta content="noindex" name="robots">
""")
end
@ -144,7 +144,7 @@ defmodule Mobilizon.Service.MetadataTest do
|> Metadata.build_tags()
|> Metadata.Utils.stringify_tags() ==
String.trim("""
<meta content="#{comment.actor.preferred_username}" property="og:title"><meta content="#{comment.url}" property="og:url"><meta content="#{comment.text}" property="og:description"><meta content="website" property="og:type"><meta content="summary" property="twitter:card">
<meta content="#{comment.actor.name}" property="og:title"><meta content="#{comment.url}" property="og:url"><meta content="#{comment.text}" property="og:description"><meta content="website" property="og:type"><meta content="summary" property="twitter:card">
""")
end
end