diff --git a/drama/routes/flagging.py b/drama/routes/flagging.py index 80eb8be8c..ce62d97ac 100644 --- a/drama/routes/flagging.py +++ b/drama/routes/flagging.py @@ -2,7 +2,7 @@ from drama.helpers.wrappers import * from drama.helpers.get import * from flask import g from drama.__main__ import app - +from drama.helpers.sanitize import sanitize @app.post("/flag/post/") @auth_desired @@ -14,9 +14,9 @@ def api_flag_post(pid, v): existing = g.db.query(Flag).filter_by( user_id=v.id, post_id=post.id).first() - if existing: - return "", 409 - reason = request.form.get("reason", "")[:100].strip() + if existing: return "", 409 + reason = sanitize(request.form.get("reason", "")[:100].strip(), flair=True) + flag = Flag(post_id=post.id, user_id=v.id, reason=reason, @@ -38,10 +38,8 @@ def api_flag_comment(cid, v): existing = g.db.query(CommentFlag).filter_by( user_id=v.id, comment_id=comment.id).first() - if existing: - return "", 409 - - reason = request.form.get("reason", "")[:100].strip() + if existing: return "", 409 + reason = sanitize(request.form.get("reason", "")[:100].strip(), flair=True) flag = CommentFlag(comment_id=comment.id, user_id=v.id, reason=reason, diff --git a/drama/routes/settings.py b/drama/routes/settings.py index e03fe5b6f..21080f569 100644 --- a/drama/routes/settings.py +++ b/drama/routes/settings.py @@ -71,8 +71,7 @@ def settings_profile_post(v): for i in re.finditer('^(https:\/\/.*\.(png|jpg|jpeg|gif|PNG|JPG|JPEG|GIF))', bio, re.MULTILINE): bio = bio.replace(i.group(1), f'![]({i.group(1)})') bio = bio.replace("\n", "\n\n").replace("\n\n\n\n\n\n", "\n\n").replace("\n\n\n\n", "\n\n").replace("\n\n\n", "\n\n") - with CustomRenderer() as renderer: - bio_html = renderer.render(mistletoe.Document(bio)) + with CustomRenderer() as renderer: bio_html = renderer.render(mistletoe.Document(bio)) bio_html = sanitize(bio_html, linkgen=True) # Run safety filter